The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unmanaged memory location, aka "System Drawing Information Disclosure Vulnerability."
Per http://technet.microsoft.com/en-us/security/bulletin/ms13-004 Microsoft .NET Framework 3.0 Service Pack 2 is not vulnerable.
[MS13-004]
[oval:org.mitre.oval:def:15814]
Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages improper counting of objects during a memory copy operation, aka "WinForms Buffer Overflow Vulnerability."
Per http://technet.microsoft.com/en-us/security/bulletin/ms13-004 Microsoft .NET Framework 3.0 Service Pack 2 is not vulnerable.
[TA13-008A]
[MS13-004]
[[santuario-commits] 20190823 svn commit: r1049214 - in /websites/production/santuario/content: cache/main.pageCache download.html index.html javaindex.html javareleasenotes.html secadv.data/CVE-2019-12400.asc secadv.html]
[oval:org.mitre.oval:def:16343]
Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a missing array-size check during a memory copy operation, aka "S.DS.P Buffer Overflow Vulnerability."
Per http://technet.microsoft.com/en-us/security/bulletin/ms13-004 Microsoft .NET Framework 3.0 Service Pack 2 is not vulnerable.
[TA13-008A]
[MS13-004]
[oval:org.mitre.oval:def:16381]
Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."
[TA13-008A]
[MS13-004]
[oval:org.mitre.oval:def:16339]
The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service (resource consumption and daemon restart) via crafted values in HTTP requests, aka "Replace Denial of Service Vulnerability."
[TA13-008A]
[MS13-007]
[oval:org.mitre.oval:def:16282]
Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
[TA13-008A]
[MS13-002]
[oval:org.mitre.oval:def:16429]
Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."
[TA13-008A]
[MS13-002]
[oval:org.mitre.oval:def:15458]
win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle window broadcast messages, which allows local users to gain privileges via a crafted application, aka "Win32k Improper Message Handling Vulnerability."
[24485]
[57135]
[TA13-008A]
[MS13-005]
[oval:org.mitre.oval:def:16326]
Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0010.
[TA13-008A]
[MS13-003]
[oval:org.mitre.oval:def:15760]
Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0009.
[TA13-008A]
[MS13-003]
[oval:org.mitre.oval:def:16232]
The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted print job, aka "Windows Print Spooler Components Vulnerability."
[TA13-008A]
[MS13-001]
[oval:org.mitre.oval:def:16357]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
The SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle encrypted packets, which allows man-in-the-middle attackers to conduct SSLv2 downgrade attacks against (1) SSLv3 sessions or (2) TLS sessions by intercepting handshakes and injecting content, aka "Microsoft SSL Version 3 and TLS Protocol Security Feature Bypass Vulnerability."
[TA13-008A]
[MS13-006]
[oval:org.mitre.oval:def:16273]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Microsoft Internet Explorer 6 through 9 does not properly perform auto-selection of the Shift JIS encoding, which allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site that triggers cross-domain scrolling events, aka "Shift JIS Character Encoding Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16371]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SetCapture Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16438]
Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer COmWindowProxy Use After Free Vulnerability."
[http://blog.skylined.nl/20161202001.html]
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16465]
[40879]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkup Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:15875]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer vtable Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16483]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer LsGetTrailInfo Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16069]
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CDispNode Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16470]
Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer pasteHTML Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16126]
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer SLayoutRun Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16294]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer InsertElement Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16472]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CPasteCommand Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16360]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CObjectElement Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16249]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CHTML Use After Free Vulnerability."
[TA13-043B]
[MS13-009]
[oval:org.mitre.oval:def:16245]
The Vector Markup Language (VML) implementation in Microsoft Internet Explorer 6 through 10 does not properly allocate buffers, which allows remote attackers to execute arbitrary code via a crafted web site, aka "VML Memory Corruption Vulnerability."
[TA13-043B]
[MS13-010]
[oval:org.mitre.oval:def:16175]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly restrict the privileges of a callback function during object creation, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "WinForms Callback Elevation Vulnerability."
[TA13-043B]
[MS13-015]
[oval:org.mitre.oval:def:16475]
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows remote attackers to execute arbitrary code via a crafted Silverlight application, aka "Silverlight Double Dereference Vulnerability."
[TA13-071A]
[MS13-022]
[oval:org.mitre.oval:def:16516]
[oval:org.mitre.oval:def:16565]
The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (reboot) via a crafted packet that terminates a TCP connection, aka "TCP FIN WAIT Vulnerability."
[TA13-043B]
[MS13-018]
[oval:org.mitre.oval:def:16373]
The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Reference Count Vulnerability."
[TA13-043B]
[MS13-019]
[oval:org.mitre.oval:def:16478]
Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via crafted media content in (1) a media file, (2) a media stream, or (3) a Microsoft Office document, aka "Media Decompression Vulnerability."
[TA13-043B]
[MS13-011]
[oval:org.mitre.oval:def:15873]
The Microsoft Antimalware Client in Windows Defender on Windows 8 and Windows RT uses an incorrect pathname for MsMpEng.exe, which allows local users to gain privileges via a crafted application, aka "Microsoft Antimalware Improper Pathname Vulnerability."
[TA13-100A]
[MS13-034]
[oval:org.mitre.oval:def:16293]
Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation, aka "Visio Viewer Tree Object Type Confusion Vulnerability."
[VU#851777]
[TA13-071A]
[20130312 Microsoft Office Visio Viewer ActiveX Type Confusion Vulnerability]
[MS13-023]
[oval:org.mitre.oval:def:16300]
Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allow remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "Callback Function Vulnerability."
[TA13-071A]
[MS13-024]
[oval:org.mitre.oval:def:16596]
Microsoft SharePoint Portal Server 2003 SP3 and SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013 do not properly process unassigned workflows, which allows remote attackers to cause a denial of service (W3WP process hang) via a crafted URL, aka "SharePoint Denial of Service Vulnerability."
[TA13-253A]
[MS13-067]
[oval:org.mitre.oval:def:19036]
Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "WPD File Format Memory Corruption Vulnerability."
[TA13-317A]
[MS13-091]
[oval:org.mitre.oval:def:19178]
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via crafted content, leading to administrative command execution, aka "SharePoint XSS Vulnerability."
[TA13-071A]
[MS13-024]
Directory traversal vulnerability in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to bypass intended read restrictions for content, and hijack user accounts, via a crafted URL, aka "SharePoint Directory Traversal Vulnerability."
[TA13-071A]
[MS13-024]
[oval:org.mitre.oval:def:16445]
Buffer overflow in Microsoft SharePoint Server 2010 SP1 and SharePoint Foundation 2010 SP1 allows remote attackers to cause a denial of service (W3WP process crash and site outage) via a crafted URL, aka "Buffer Overflow Vulnerability."
[TA13-071A]
[MS13-024]
[oval:org.mitre.oval:def:16414]
Microsoft OneNote 2010 SP1 does not properly determine buffer sizes during memory allocation, which allows remote attackers to obtain sensitive information via a crafted OneNote file, aka "Buffer Size Validation Vulnerability."
[TA13-071A]
[MS13-025]
[oval:org.mitre.oval:def:16539]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer OnResize Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16583]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer saveHistory Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16386]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CMarkupBehaviorContext Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16587]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CCaret Use After Free Vulnerability."
[http://blog.skylined.nl/20161216001.html]
[http://packetstormsecurity.com/files/140186/Microsoft-Internet-Explorer-9-IEFRAME-CView-EnsureSize-Use-After-Free.html]
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16049]
[40935]
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CElement Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16526]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer GetMarkupPtr Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16324]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer onBeforeCopy Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16239]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer removeChild Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16634]
Outlook in Microsoft Office for Mac 2008 before 12.3.6 and Office for Mac 2011 before 14.3.2 allows remote attackers to trigger access to a remote URL and consequently confirm the rendering of an HTML e-mail message by including unspecified HTML5 elements and leveraging the installation of a WebKit browser on the victim's machine, aka "Unintended Content Loading Vulnerability."
[TA13-071A]
[MS13-026]
[oval:org.mitre.oval:def:16082]
Writer in Microsoft Windows Essentials 2011 and 2012 allows remote attackers to bypass proxy settings and overwrite arbitrary files via crafted URL parameters, aka "Windows Essentials Improper URI Handling Vulnerability."
Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-045
'There is no update available for Windows Essentials 2011. See update FAQ for details.'
[TA13-134A]
[MS13-045]
[oval:org.mitre.oval:def:16204]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Stack-based buffer overflow in Foxit Advanced PDF Editor 3 before 3.04 might allow remote attackers to execute arbitrary code via a crafted document containing instructions that reconstruct a certain security cookie.
[VU#275219]
An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-053-02.pdf]
The NVIDIA driver before 307.78, and Release 310 before 311.00, in the NVIDIA Display Driver service on Windows does not properly handle exceptions, which allows local users to gain privileges or cause a denial of service (memory overwrite) via a crafted application.
[VU#957036]
[http://www.nvidia.com/object/product-security.html]
nvSCPAPISvr.exe in the NVIDIA Stereoscopic 3D Driver service, as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.
[VU#957036]
[http://www.nvidia.com/object/product-security.html]
daemonu.exe (aka the NVIDIA Update Service Daemon), as distributed with the NVIDIA driver before 307.78, and Release 310 before 311.00, on Windows, lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program.
[VU#957036]
[http://www.nvidia.com/object/product-security.html]
Nuance PDF Reader 7.0 and PDF Viewer Plus 7.1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document.
[VU#248449]
CS-Cart before 3.0.6, when PayPal Standard Payments is configured, allows remote attackers to set the payment recipient via a modified value of the merchant's e-mail address, as demonstrated by setting the recipient to one's self.
[VU#583564]
[http://www.kb.cert.org/vuls/id/BLUU-949PQL]
The web interface on Dell PowerConnect 6248P switches allows remote attackers to cause a denial of service (device crash) via a malformed request.
[VU#160460]
The avast! Mobile Security application before 2.0.4400 for Android allows attackers to cause a denial of service (application crash) via a crafted application that sends an intent to com.avast.android.mobilesecurity.app.scanner.DeleteFileActivity with zero arguments.
[VU#131263]
Multiple SQL injection vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to execute arbitrary SQL commands via (1) the nHistoryId parameter to WebProd/pages/pgHistory.asp or (2) the OrderBy parameter to WebProd/pages/pgadmin.asp.
[VU#406596]
Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the (1) Number or (2) UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll.
[VU#406596]
Cross-site scripting (XSS) vulnerability in fileview.asp in C2 WebResource allows remote attackers to inject arbitrary web script or HTML via the File parameter.
[VU#418923]
Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.
[http://infosec42.blogspot.com/2013/03/verizon-fios-router-csrf-cve-2013-0126.html]
[24860]
[VU#278204]
IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 does not block APPLET elements in HTML e-mail, which allows remote attackers to bypass intended restrictions on Java code execution and X-Confirm-Reading-To functionality via a crafted message, aka SPRs JMOY95BLM6 and JMOY95BN49.
[20130501 n.runs-SA-2013.005 - IBM Lotus Notes - arbitrary code execution]
[VU#912420]
[http://www-01.ibm.com/support/docview.wss?uid=swg21633819]
[ibm-notes-applet-tags(83775)]
The Contact Customer Support feature in the TigerText Free Private Texting app before 3.1.402 for iOS sends a log-file e-mail message with unencrypted credentials, which allows remote attackers to obtain sensitive information by sniffing the network or leveraging access to an e-mail endpoint.
[VU#704916]
Multiple cross-site scripting (XSS) vulnerabilities in pd-admin before 4.17 allow remote authenticated users to inject arbitrary web script or HTML via (1) the WebFTP Overview "Create new directory" field or (2) the body of an e-mail autoresponder message.
[VU#311644]
[http://www.pdadmin-forum.de/thread.php?threadid=4051]
Multiple buffer overflows in Core FTP before 2.2 build 1769 allow remote FTP servers to execute arbitrary code or cause a denial of service (application crash) via a long directory name in a (1) DELE, (2) LIST, or (3) VIEW command.
[http://www.coreftp.com/forums/viewtopic.php?t=222102]
[VU#370868]
Buffer overflow in the NVIDIA GPU driver before 304.88, 310.x before 310.44, and 313.x before 313.30 for the X Window System on UNIX, when NoScanout mode is enabled, allows remote authenticated users to execute arbitrary code via a large ARGB cursor.
[http://nvidia.custhelp.com/app/answers/detail/a_id/3290]
[GLSA-201304-01]
[VU#771620]
[http://www.nvidia.com/object/product-security.html]
The suexec implementation in Parallels Plesk Panel 11.0.9 contains a cgi-wrapper whitelist entry, which allows user-assisted remote attackers to execute arbitrary PHP code via a request containing crafted environment variables.
[VU#310500]
Untrusted search path vulnerability in /usr/local/psa/admin/sbin/wrapper in Parallels Plesk Panel 11.0.9 allows local users to gain privileges via a crafted PATH environment variable.
Per: http://cwe.mitre.org/data/definitions/426.html
'CWE-426: Untrusted Search Path'
[VU#310500]
Cross-site scripting (XSS) vulnerability in the web interface in AirDroid allows remote attackers to inject arbitrary web script or HTML via a crafted text message that is transmitted by a managed phone.
[VU#557252]
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via the id parameter to (1) addressbook/register/delete_user.php, (2) addressbook/register/edit_user.php, or (3) addressbook/register/edit_user_save.php; the email parameter to (4) addressbook/register/edit_user_save.php, (5) addressbook/register/reset_password.php, (6) addressbook/register/reset_password_save.php, or (7) addressbook/register/user_add_save.php; the username parameter to (8) addressbook/register/checklogin.php or (9) addressbook/register/reset_password_save.php; the (10) lastname, (11) firstname, (12) phone, (13) permissions, or (14) notes parameter to addressbook/register/edit_user_save.php; the (15) q parameter to addressbook/register/admin_index.php; the (16) site parameter to addressbook/register/linktick.php; the (17) password parameter to addressbook/register/reset_password.php; the (18) password_hint parameter to addressbook/register/reset_password_save.php; the (19) var parameter to addressbook/register/traffic.php; or a (20) BasicLogin cookie to addressbook/register/router.php.
[http://packetstormsecurity.com/files/129789/PHP-Address-Book-Cross-Site-Scripting-SQL-Injection.html]
[http://www.acadion.nl/labs/advisory/20130203-phpaddressbook.html]
[VU#183692]
[phpaddressbook-checklogin-auth-bypass(99623)]
Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1) the uploadPath parameter in an UPLOAD operation; the paths[] parameter in a (2) DELETE, (3) CUT, or (4) COPY operation; or the newPath parameter in a (5) CUT or (6) COPY operation.
[VU#701572]
[https://community.rapid7.com/community/metasploit/blog/2013/05/15/new-1day-exploits-mutiny-vulnerabilities]
The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189 One-Net EAS device before 2.0-2 contains a known SSH private key, which makes it easier for remote attackers to obtain root access, and spoof alerts, via an SSH session.
[http://www.digitalalertsystems.com/pdf/130604-Monroe-Security-PR.pdf]
[VU#662676]
[http://www.kb.cert.org/vuls/id/AAMN-98MU7H]
[http://www.kb.cert.org/vuls/id/AAMN-98MUK2]
[http://www.monroe-electronics.com/MONROE_ELECTRONICS_PDF/130604-Monroe-Security-PR.pdf]
BitZipper 2013 before Update 1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ZIP archive.
[VU#880916]
[http://www.kb.cert.org/vuls/id/BLUU-95GP23]
The Arecont Vision AV1355DN MegaDome camera allows remote attackers to cause a denial of service (video-capture outage) via a packet to UDP port 69.
[VU#375180]
SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
[20140427 Re: Exploit: McAfee ePolicy 0wner (ePowner ) ââ?¬â?? Release]
[VU#209131]
[59500]
[TA13-193A]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10042]
Directory traversal vulnerability in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to upload arbitrary files via a crafted request over the Agent-Server communication channel, as demonstrated by writing to the Software/ directory.
[20140427 Re: Exploit: McAfee ePolicy 0wner (ePowner ) ââ?¬â?? Release]
[VU#209131]
[TA13-193A]
[https://kc.mcafee.com/corporate/index?page=content&id=SB10042]
QNAP VioStor NVR devices with firmware 4.0.3, and the Surveillance Station Pro component in QNAP NAS, have a hardcoded guest account, which allows remote attackers to obtain web-server login access via unspecified vectors.
[VU#927644]
cgi-bin/pingping.cgi on QNAP VioStor NVR devices with firmware 4.0.3, and in the Surveillance Station Pro component in QNAP NAS, allows remote authenticated users to execute arbitrary commands by leveraging guest access and placing shell metacharacters in the query string.
[VU#927644]
Cross-site request forgery (CSRF) vulnerability in cgi-bin/create_user.cgi on QNAP VioStor NVR devices with firmware 4.0.3 allows remote attackers to hijack the authentication of administrators for requests that create administrative accounts via a NEW USER action.
[VU#927644]
Buffer overflow in the TFTPD service in Serva32 2.1.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long string in a read request.
[VU#127108]
The Data Camouflage (aka FairCom Standard Encryption) algorithm in FairCom c-treeACE does not ensure that a decryption key is needed for accessing database contents, which allows context-dependent attackers to read cleartext database records by copying a database to another system that has a certain default configuration.
[VU#900031]
The OSPF implementation in Cisco IOS 12.0 through 12.4 and 15.0 through 15.3, IOS-XE 2.x through 3.9.xS, ASA and PIX 7.x through 9.1, FWSM, NX-OS, and StarOS before 14.0.50488 does not properly validate Link State Advertisement (LSA) type 1 packets before performing operations on the LSA database, which allows remote attackers to cause a denial of service (routing disruption) or obtain sensitive packet information via a (1) unicast or (2) multicast packet, aka Bug IDs CSCug34485, CSCug34469, CSCug39762, CSCug63304, and CSCug39795.
[20130801 OSPF LSA Manipulation Vulnerability in Multiple Cisco Products]
[VU#229804]
Directory traversal vulnerability in an unspecified signed Java applet in the client-side components in F5 BIG-IP APM 10.1.0 through 10.2.4 and 11.0.0 through 11.3.0, FirePass 6.0.0 through 6.1.0 and 7.0.0, and other products "when APM is provisioned," allows remote attackers to upload and execute arbitrary files via a .. (dot dot) in the filename parameter.
[http://support.f5.com/kb/en-us/solutions/public/14000/400/sol14468.html]
[https://nealpoole.com/blog/2013/07/code-execution-via-f5-networks-java-applet/]
The do_hvm_op function in xen/arch/x86/hvm/hvm.c in Xen 4.2.x on the x86_32 platform does not prevent HVM_PARAM_NESTEDHVM (aka nested virtualization) operations, which allows guest OS users to cause a denial of service (long-duration page mappings and host OS crash) by leveraging administrative access to an HVM guest in a domain with a large number of VCPUs.
[[oss-security] 20130122 Xen Security Advisory 34 (CVE-2013-0151) - nested virtualization on 32-bit exposes host crash]
[GLSA-201309-24]
[http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=d60d7082289a74e44b3dc8f67df46c3404ca08bf]
Memory leak in Xen 4.2 and unstable allows local HVM guests to cause a denial of service (host memory consumption) by performing nested virtualization in a way that triggers errors that are not properly handled.
[GLSA-201309-24]
[[oss-security] 20130123 Xen Security Advisory 35 (CVE-2013-0152) - Nested HVM exposes host to being driven out of memory by guest]
[1028032]
The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.
[SUSE-SU-2014:0446]
[openSUSE-SU-2013:0636]
[openSUSE-SU-2013:0637]
[openSUSE-SU-2013:0912]
[RHSA-2013:0847]
[GLSA-201309-24]
[DSA-2636]
[[oss-security] 20130205 Xen Security Advisory 36 (CVE-2013-0153) - interrupt remap entries shared and old ones not cleared on AMD IOMMUs]
[57745]
[xen-amdiommu-dos(81831)]
The get_page_type function in xen/arch/x86/mm.c in Xen 4.2, when debugging is enabled, allows local PV or HVM guest administrators to cause a denial of service (assertion failure and hypervisor crash) via unspecified vectors related to a hypercall.
[SUSE-SU-2014:0446]
[openSUSE-SU-2013:0636]
[openSUSE-SU-2013:0637]
[http://seclists.org/oss-sec/2013/q1/att-17/xsa37-4_2.patch]
[GLSA-201309-24]
[[oss-security] 20130104 Xen Security Advisory 37 (CVE-2013-0154) - Hypervisor crash due to incorrect ASSERT (debug build only)]
[57159]
[1027937]
[xen-hypercall-dos(80977)]
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A]
[APPLE-SA-2013-06-04-1]
[openSUSE-SU-2013:1904]
[openSUSE-SU-2013:1906]
[openSUSE-SU-2013:1907]
[openSUSE-SU-2014:0009]
[RHSA-2013:0154]
[RHSA-2013:0155]
[http://support.apple.com/kb/HT5784]
[DSA-2609]
[[rubyonrails-security] 20130108 Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155)]
[https://puppet.com/security/cve/cve-2013-0155]
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A]
[APPLE-SA-2013-03-14-1]
[RHSA-2013:0153]
[RHSA-2013:0154]
[RHSA-2013:0155]
[http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/]
[DSA-2604]
[http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html]
[http://www.insinuator.net/2013/01/rails-yaml/]
[VU#380039]
[VU#628463]
[https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156]
[[rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156)]
[https://puppet.com/security/cve/cve-2013-0156]
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.
[http://bugs.debian.org/697464]
[[oss-security] 20130106 Re: CVE request: mount/umount leak information about existence of folders]
[RHSA-2013:0517]
[MDVSA-2013:154]
[https://bugzilla.redhat.com/show_bug.cgi?id=892330]
Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
[RHSA-2013:0220]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-01-04.cb]
[[oss-security] 20130107 Re: CVE Request: Jenkins possible remote code execution]
[https://bugzilla.redhat.com/show_bug.cgi?id=892795]
[https://github.com/jenkinsci/jenkins/commit/3dc13b957b14cec649036e8dd517f0f9cb21fb04]
[https://github.com/jenkinsci/jenkins/commit/4895eaafca468b7f0f1a3166b2fca7414f0d5da5]
[https://github.com/jenkinsci/jenkins/commit/94a8789b699132dd706021a6be1b78bc47f19602]
[https://github.com/jenkinsci/jenkins/commit/a9aff088f327278a8873aef47fa8f80d3c5932fd]
[https://github.com/jenkinsci/jenkins/commit/c3d8e05a1b3d58b6c4dcff97394cb3a79608b4b2]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04]
The fedora-business-cards package before 1-0.1.beta1.fc17 on Fedora 17 and before 1-0.1.beta1.fc18 on Fedora 18 allows local users to cause a denial of service or write to arbitrary files via a symlink attack on /tmp/fedora-business-cards-buffer.svg.
[https://bugzilla.redhat.com/show_bug.cgi?id=892299]
[https://bugzilla.redhat.com/show_bug.cgi?id=892815]
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.
[openSUSE-SU-2013:0395]
[SUSE-SU-2013:0674]
[openSUSE-SU-2013:0925]
[SUSE-SU-2013:1182]
[openSUSE-SU-2013:1187]
[[oss-security] 20130107 Re: /dev/ptmx timing]
[USN-2128-1]
[USN-2129-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=892983]
The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
[RHSA-2013:0544]
[RHSA-2013:0548]
[https://bugzilla.redhat.com/show_bug.cgi?id=892806]
The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
[RHSA-2013:0220]
[https://bugzilla.redhat.com/show_bug.cgi?id=893307]
[https://github.com/openshift/origin-server/commit/524465f70a32d0eb6bf047e6a05c76c22d52bfa2]
[https://github.com/openshift/origin-server/pull/1136]
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.
[http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=62e4506a7d4cec1c8e1ff687f6b220f6a62a57c7]
[http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=66e8211c0b1347970096e04b18aa52567c325200]
[http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=ebc71865f0506a293242bd4aec97cdc7a8ef24b0]
[APPLE-SA-2013-09-12-1]
[SUSE-SU-2015:0578]
[openSUSE-SU-2016:0640]
[HPSBUX02856]
[SSRT101108]
[SSRT101289]
[RHSA-2013:0587]
[RHSA-2013:0782]
[RHSA-2013:0783]
[RHSA-2013:0833]
[http://support.apple.com/kb/HT5880]
[DSA-2621]
[VU#737740]
[http://www.openssl.org/news/secadv_20130204.txt]
[http://www.splunk.com/view/SP-CAAAHXG]
[https://bugzilla.redhat.com/show_bug.cgi?id=908052]
[oval:org.mitre.oval:def:18754]
[oval:org.mitre.oval:def:19081]
[oval:org.mitre.oval:def:19360]
[oval:org.mitre.oval:def:19487]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001]
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."
[https://bugzilla.redhat.com/show_bug.cgi?id=893332]
[RHSA-2013:0886]
[RHSA-2013:0907]
The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.
[RHSA-2013:0211]
[57750]
[1028076]
[https://bugzilla.redhat.com/show_bug.cgi?id=893355]
[entreprise-movedisk-dos(81834)]
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.
Per http://www.openssl.org/news/vulnerabilities.html:
Fixed in OpenSSL 1.0.1d (Affected 1.0.1c, 1.0.1b, 1.0.1a, 1.0.1)
Fixed in OpenSSL 1.0.0k (Affected 1.0.0j, 1.0.0i, 1.0.0g, 1.0.0f, 1.0.0e, 1.0.0d, 1.0.0c, 1.0.0b, 1.0.0a, 1.0.0)
Fixed in OpenSSL 0.9.8y (Affected 0.9.8x, 0.9.8w, 0.9.8v, 0.9.8u, 0.9.8t, 0.9.8s, 0.9.8r, 0.9.8q, 0.9.8p, 0.9.8o, 0.9.8n, 0.9.8m, 0.9.8l, 0.9.8k, 0.9.8j, 0.9.8i, 0.9.8h, 0.9.8g, 0.9.8f, 0.9.8d, 0.9.8c, 0.9.8b, 0.9.8a, 0.9.8)
Affected users should upgrade to OpenSSL 1.0.1e, 1.0.0k or 0.9.8y
(The fix in 1.0.1d wasn't complete, so please use 1.0.1e or later)
[http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/]
[APPLE-SA-2013-09-12-1]
[FEDORA-2013-4403]
[SUSE-SU-2013:0328]
[openSUSE-SU-2013:0375]
[openSUSE-SU-2013:0378]
[SUSE-SU-2013:0701]
[SUSE-SU-2014:0320]
[SUSE-SU-2015:0578]
[openSUSE-SU-2016:0640]
[HPSBUX02856]
[SSRT101108]
[HPSBUX02857]
[HPSBMU02874]
[SSRT101289]
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[RHSA-2013:0587]
[RHSA-2013:0782]
[RHSA-2013:0783]
[RHSA-2013:0833]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[http://support.apple.com/kb/HT5880]
[DSA-2621]
[DSA-2622]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[VU#737740]
[MDVSA-2013:095]
[http://www.matrixssl.org/news.html]
[http://www.openssl.org/news/secadv_20130204.txt]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html]
[57778]
[1029190]
[http://www.splunk.com/view/SP-CAAAHXG]
[USN-1735-1]
[TA13-051A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644047]
[https://cert-portal.siemens.com/productcert/pdf/ssa-556833.pdf]
[[debian-lts-announce] 20180925 [SECURITY] [DLA 1518-1] polarssl security update]
[oval:org.mitre.oval:def:18841]
[oval:org.mitre.oval:def:19016]
[oval:org.mitre.oval:def:19424]
[oval:org.mitre.oval:def:19540]
[oval:org.mitre.oval:def:19608]
[https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released]
[https://puppet.com/security/cve/cve-2013-0169]
[https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c03883001]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084]
Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2, 0.10.2 before 0.10.2.3, 0.9.11 before 0.9.11.9, and 0.9.6 before 0.9.6.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering certain errors during an RPC connection, which causes a message to be freed without being removed from the message queue.
[http://libvirt.org/git/?p=libvirt.git;a=commit;h=46532e3e8ed5f5a736a02f67d6c805492f9ca720]
[http://libvirt.org/news.html]
[FEDORA-2013-1644]
[FEDORA-2013-1642]
[FEDORA-2013-1626]
[openSUSE-SU-2013:0274]
[openSUSE-SU-2013:0275]
[SUSE-SU-2013:0320]
[RHSA-2013:0199]
[http://wiki.libvirt.org/page/Maintenance_Releases]
[57578]
[1028047]
[USN-1708-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=893450]
[libvirt-virnetmessagefree-code-exec(81552)]
Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.
[http://projects.theforeman.org/issues/2069]
[http://theforeman.org/security.html]
Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
[http://www.samba.org/samba/security/CVE-2013-0172]
Foreman before 1.1 uses a salt of "foreman" to hash root passwords, which makes it easier for attackers to guess the password via a brute force attack.
[http://projects.theforeman.org/issues/2069]
[http://theforeman.org/security.html]
The external node classifier (ENC) API in Foreman before 1.1 allows remote attackers to obtain the hashed root password via an API request.
[http://projects.theforeman.org/issues/2069]
[http://theforeman.org/security.html]
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
[[oss-security] 20130111 Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156)]
[https://gist.github.com/nate/d7f6d9f4925f413621aa]
[https://github.com/sferik/multi_xml/pull/34]
[https://groups.google.com/forum/?fromgroups=#!topic/ruby-grape/fthDkMgIOa0]
[https://news.ycombinator.com/item?id=5040457]
The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.
[FEDORA-2013-1422]
[FEDORA-2013-1407]
[http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/]
[USN-1707-1]
[libssh-publickeyfromprivatekey-dos(81595)]
Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1) Screenlet.title or (2) Image.alt Widget attribute, as demonstrated by the parentPortalPageId parameter to exampleext/control/ManagePortalPages.
[http://ofbiz.apache.org/download.html#vulnerabilities]
[http://packetstormsecurity.com/files/119673/Apache-OFBiz-Cross-Site-Scripting.html]
[20130118 [CVE-2013-0177] Cross-Site Scripting (XSS) Vulnerability in Apache OFBiz]
[apache-ofbiz-xss(81398)]
[https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432395]
[https://fisheye6.atlassian.com/changelog/ofbiz?cs=1432850]
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.
[[oss-security] 20130114 CVE request: memcached DoS when printing out keys to be deleted in verbose mode]
[[oss-security] 20130114 Re: CVE request: memcached DoS when printing out keys to be deleted in verbose mode]
[64978]
[USN-2080-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=895054]
[https://code.google.com/p/memcached/issues/attachmentText?id=306&aid=3060004000&name=0001-Fix-buffer-overrun-when-logging-key-to-delete-in-bin.patch&token=3GEzHThBL5cxmUrsYANkW03RrNY%3A1358179503096]
[https://code.google.com/p/memcached/issues/detail?id=306]
[https://code.google.com/p/memcached/wiki/ReleaseNotes1417]
Cross-site scripting (XSS) vulnerability in Views in the Search API (search_api) module 7.x-1.x before 7.x-1.4 for Drupal, when using certain backends and facets, allows remote attackers to inject arbitrary web script or HTML via unspecified input, which is returned in an error message.
[http://drupalcode.org/project/search_api.git/commitdiff/35b5728]
[[oss-security] 20130114 Re: CVE request for Drupal contributed modules]
[57231]
[https://drupal.org/node/1884076]
[https://drupal.org/node/1884332]
[drupal-searchapi-unspecified-xss(81153)]
The Payment module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict access to payments, which allows remote attackers to read arbitrary payments.
[http://drupal.org/node/1871508]
[http://drupal.org/node/1883830]
[http://drupalcode.org/project/payment.git/commitdiff/62c9186]
[[oss-security] 20130114 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1884360]
multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.
[openSUSE-SU-2013:0462]
[http://rack.github.com/]
[RHSA-2013:0544]
[RHSA-2013:0548]
[DSA-2783]
[https://bugzilla.redhat.com/show_bug.cgi?id=895282]
[https://github.com/rack/rack/commit/548b9af2dc0059f4c0c19728624448d84de450ff]
[https://github.com/rack/rack/commit/f95113402b7239f225282806673e1b6424522b18]
[https://groups.google.com/forum/#!topic/rack-devel/7ZKPNAjgRSs]
[https://groups.google.com/forum/#!topic/rack-devel/-MWPHDeGWtI]
Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to "symbolized arbitrary strings."
[openSUSE-SU-2013:0462]
[RHSA-2013:0544]
[RHSA-2013:0548]
[DSA-2783]
[https://bugzilla.redhat.com/show_bug.cgi?id=895384]
Cross-site request forgery (CSRF) vulnerability in ManageIQ Enterprise Virtualization Manager (EVM) allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.
[https://bugzilla.redhat.com/show_bug.cgi?id=895345]
Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.
[http://theforeman.org/security.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-0189, CVE-2013-0191. Reason: this identifier was intended for one issue, but it was inadvertently associated with multiple issues. Notes: All CVE users should consult CVE-2013-0189 and CVE-2013-0191 to determine which ID is appropriate. All references and descriptions in this candidate have been removed to prevent accidental usage.
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request. NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.
Per http://www.ubuntu.com/usn/USN-1713-1/
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
[http://bazaar.launchpad.net/~squid/squid/3.2/revision/11743]
[http://bazaar.launchpad.net/~squid/squid/3.2/revision/11744]
[[scm-commits] 20130125 [squid/f17] CVE-2013-0189: Incomplete fix for the CVE-2012-5643]
[SUSE-SU-2016:1996]
[SUSE-SU-2016:2089]
[openSUSE-SU-2013:1436]
[openSUSE-SU-2013:1443]
[DSA-2631]
[MDVSA-2013:129]
[57646]
[http://www.squid-cache.org/Versions/v3/3.1/changesets/SQUID-2012_1.patch]
[http://www.squid-cache.org/Versions/v3/3.2/changesets/SQUID-2012_1.patch]
[USN-1713-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=887962#c9]
[https://bugzilla.redhat.com/show_bug.cgi?id=895972]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0029]
The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.
[RHSA-2013:0496]
[[oss-security] 20130116 [PATCH] xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.]
[[oss-security] 20130116 Xen Security Advisory 40 (CVE-2013-0190) - Linux stack corruption in xen_failsafe_callback for 32bit PVOPS guests.]
[57433]
[USN-1725-1]
[USN-1728-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=896038]
libpam-pgsql (aka pam_pgsql) 0.7 does not properly handle a NULL value returned by the password search query, which allows remote attackers to bypass authentication via a crafted password.
[SUSE-SU-2016:1996]
[SUSE-SU-2016:2089]
[[oss-security] 20130115 pam-pgsql NULL password handling issue]
[[oss-security] 20130116 Re: pam-pgsql NULL password handling issue]
[http://sourceforge.net/p/pam-pgsql/bugs/13/]
[http://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/]
[57440]
[libpampgsql-password-sec-bypass(81363)]
Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php.
[http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html]
[[oss-security] 20130118 CVE request: MantisBT before 1.2.13 match_type XSS vulnerability]
[[oss-security] 20130118 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability]
[[oss-security] 20130121 Re: CVE request: MantisBT before 1.2.13 match_type XSS vulnerability]
[http://www.mantisbt.org/bugs/view.php?id=15373]
Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.
[MDVSA-2013:072]
[[oss-security] 20130118 CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue]
[[oss-security] 20130118 Re: CVE Request -- dnsmasq: Incomplete fix for the CVE-2012-3411 issue]
[http://www.thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commitdiff;h=22ce550e5346947a12a781ed0959a7b1165d0dc6]
[https://bugzilla.redhat.com/show_bug.cgi?id=894486]
The default LDAP ACIs in FreeIPA 3.0 before 3.1.2 do not restrict access to the (1) ipaNTTrustAuthIncoming and (2) ipaNTTrustAuthOutgoing attributes, which allow remote attackers to obtain the Cross-Realm Kerberos Trust key via unspecified vectors.
[http://www.freeipa.org/page/CVE-2013-0199]
[http://www.freeipa.org/page/Releases/3.1.2]
[57542]
[freeipa-crossrealm-info-disc(81486)]
HP Linux Imaging and Printing (HPLIP) through 3.12.4 allows local users to overwrite arbitrary files via a symlink attack on the (1) /tmp/hpcupsfilterc_#.bmp, (2) /tmp/hpcupsfilterk_#.bmp, (3) /tmp/hpcups_job#.out, (4) /tmp/hpijs_#####.out, or (5) /tmp/hpps_job#.out temporary file, a different vulnerability than CVE-2011-2722.
Per https://access.redhat.com/security/cve/CVE-2013-0200
"This issue has been addressed in Red Hat Enterprise Linux 6 via RHSA-2013:0500."
[ftp://ftp.scientificlinux.org/linux/scientific/6x/SRPMS/vendor/hplip-3.12.4-4.el6.src.rpm]
[http://hplipopensource.com/hplip-web/release_notes.html]
[DSA-2829]
[MDVSA-2013:088]
[USN-1981-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=902163]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0072]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.5, 4.0.10, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) QUERY_STRING to core/lostpassword/templates/resetpassword.php, (2) mime parameter to apps/files/ajax/mimeicon.php, or (3) token parameter to apps/gallery/sharing.php.
[http://owncloud.org/about/security/advisories/oC-SA-2013-001]
[owncloud-mime-token-xss(81475)]
[https://github.com/owncloud/core/commit/4e2b834]
[https://github.com/owncloud/core/commit/b8e0309]
settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings.
[http://owncloud.org/about/security/advisories/oC-SA-2013-002/]
Cross-site request forgery (CSRF) vulnerability in the RESTful Web Services (restws) module 7.x-1.x before 7.x-1.2 and 7.x-2.x before 7.x-2.0-alpha4 for Drupal allows remote attackers to hijack the authentication of arbitrary users via unknown vectors.
[[oss-security] 20130121 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1890212]
[https://drupal.org/node/1890216]
[https://drupal.org/node/1890222]
Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the "administer CSS" permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory.
CWE-434: Unrestricted Upload of File with Dangerous Type
[http://drupal.org/node/1883976]
[http://drupal.org/node/1883978]
[http://drupalcode.org/project/live_css.git/commitdiff/cb7005f]
[http://drupalcode.org/project/live_css.git/commitdiff/ef323c8]
[[oss-security] 20130121 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1890318]
Cross-site request forgery (CSRF) vulnerability in the Mark Complete module 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[http://drupalcode.org/project/mark_complete.git/commitdiff/a18c7b2]
[[oss-security] 20130121 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1890538]
[https://drupal.org/node/1890566]
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.
Per http://www.ubuntu.com/usn/USN-1709-1/
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
[RHSA-2013:0208]
[[oss-security] 20130129 [OSSA 2013-001] Boot from volume allows access to random volumes (CVE-2013-0208)]
[57613]
[USN-1709-1]
[https://bugs.launchpad.net/nova/+bug/1069904]
[https://bugzilla.redhat.com/show_bug.cgi?id=902629]
[nova-volume-security-bypass(81697)]
[https://github.com/openstack/nova/commit/243d516cea9d3caa5a8267b12d2f577dcb24193b]
[https://github.com/openstack/nova/commit/317cc0af385536dee43ef2addad50a91357fc1ad]
lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated by an eval injection attack against the core_drop_meta_for_table function, leading to execution of arbitrary Perl code.
[[oss-security] 20130121 Re: CVE request for Movable Type]
[http://www.movabletype.org/2013/01/movable_type_438_patch.html]
[http://www.sec-1.com/blog/?p=402]
[http://www.sec-1.com/blog/wp-content/uploads/2013/01/movabletype_upgrade_exec.rb_.txt]
The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.
[http://theforeman.org/security.html]
Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.
[FEDORA-2013-4592]
[FEDORA-2013-4576]
[FEDORA-2013-4537]
[FEDORA-2013-4522]
[openSUSE-SU-2015:0568]
[MDVSA-2013:147]
[58926]
[1035995]
[USN-2549-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=902998]
[https://github.com/libarchive/libarchive/commit/22531545514043e04633e1c015c7540b9de9dbe4]
[FreeBSD-SA-16:23]
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Per http://www.ubuntu.com/usn/usn-1710-1/
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10, Ubuntu 12.04 LTS, Ubuntu 11.10
[RHSA-2013:0209]
[USN-1710-1]
[[oss-security] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)]
[https://bugs.launchpad.net/glance/+bug/1098962]
[https://bugzilla.redhat.com/show_bug.cgi?id=902964]
[https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7]
[https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1]
[https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89]
[https://launchpad.net/glance/+milestone/2012.2.3]
[[openstack] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)]
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.
Per: http://capec.mitre.org/data/definitions/103.html
"CAPEC-103: Clickjacking"
[SUSE-SU-2013:0326]
[SUSE-SU-2013:0519]
[openSUSE-SU-2013:0277]
[openSUSE-SU-2013:0281]
[RHSA-2013:1310]
[RHSA-2013:1542]
[RHSA-2014:0305]
[DSA-2617]
[http://www.samba.org/samba/security/CVE-2013-0213]
[57631]
[USN-2922-1]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993]
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.
[SUSE-SU-2013:0326]
[SUSE-SU-2013:0519]
[openSUSE-SU-2013:0277]
[openSUSE-SU-2013:0281]
[RHSA-2013:1310]
[RHSA-2013:1542]
[RHSA-2014:0305]
[DSA-2617]
[http://www.samba.org/samba/security/CVE-2013-0214]
[57631]
[USN-2922-1]
[https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05115993]
oxenstored in Xen 4.1.x, Xen 4.2.x, and xen-unstable does not properly consider the state of the Xenstore ring during read operations, which allows guest OS users to cause a denial of service (daemon crash and host-control outage, or memory consumption) or obtain sensitive control-plane data by leveraging guest administrative access.
[[oss-security] 20130205 Xen Security Advisory 38 (CVE-2013-0215) - oxenstored incorrect handling of certain Xenbus ring states]
[GLSA-201309-24]
[http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=40f9c5e0a6d15b4ca1f6d4ed3a46f0871520eab5]
[http://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=61401264eb00fae4ee4efc8e9a5067449283207b]
The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=48856286b64e4b66ec62b94e504d0b29c1ade664]
[openSUSE-SU-2013:0395]
[SUSE-SU-2013:0674]
[openSUSE-SU-2013:0925]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8]
[MDVSA-2013:176]
[[oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring.]
[https://bugzilla.redhat.com/show_bug.cgi?id=910883]
[https://github.com/torvalds/linux/commit/48856286b64e4b66ec62b94e504d0b29c1ade664]
Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=7d5145d8eb2b9791533ffe4dc003b129b9696c48]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.8]
[MDVSA-2013:176]
[[oss-security] 20130205 Xen Security Advisory 39 (CVE-2013-0216,CVE-2013-0217) - Linux netback DoS via malicious guest ring.]
[https://bugzilla.redhat.com/show_bug.cgi?id=910883]
[https://github.com/torvalds/linux/commit/7d5145d8eb2b9791533ffe4dc003b129b9696c48]
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by reading this file.
Per http://rhn.redhat.com/errata/RHSA-2013-0206.html
"An update for JBoss Enterprise Application Platform 5.2.0 which fixes one
security issue is now available from the Red Hat Customer Portal."
Per http://rhn.redhat.com/errata/RHSA-2013-0207.html
"An update for JBoss Enterprise Web Platform 5.2.0 which fixes one security
issue is now available from the Red Hat Customer Portal."
[RHSA-2013:0206]
[RHSA-2013:0207]
[RHSA-2013:0833]
[57652]
[https://bugzilla.redhat.com/show_bug.cgi?id=903073]
[jboss-eap-info-disc(81725)]
System Security Services Daemon (SSSD) before 1.9.4, when (1) creating, (2) copying, or (3) removing a user home directory tree, allows local users to create, modify, or delete arbitrary files via a symlink attack on another user's files.
Per https://access.redhat.com/security/cve/CVE-2013-0219
This issue affects the version of sssd shipped with Red Hat Enterprise Linux 5 and 6.
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=020bf88fd1c5bdac8fc671b37c7118f5378c7047]
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=3843b284cd3e8f88327772ebebc7249990fd87b9]
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=94cbf1cfb0f88c967f1fb0a4cf23723148868e4a]
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=e864d914a44a37016736554e9257c06b18c57d37]
[FEDORA-2013-1795]
[FEDORA-2013-1826]
[RHSA-2013:0508]
[RHSA-2013:1319]
[57539]
[https://bugzilla.redhat.com/show_bug.cgi?id=884254]
[https://fedorahosted.org/sssd/ticket/1782]
[https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4]
The (1) sss_autofs_cmd_getautomntent and (2) sss_autofs_cmd_getautomntbyname function in responder/autofs/autofssrv_cmd.c and the (3) ssh_cmd_parse_request function in responder/ssh/sshsrv_cmd.c in System Security Services Daemon (SSSD) before 1.9.4 allow remote attackers to cause a denial of service (out-of-bounds read, crash, and restart) via a crafted SSSD packet.
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=2bd514cfde1938b1e245af11c9b548d58d49b325]
[http://git.fedorahosted.org/cgit/sssd.git/commit/?id=30e2585dd46b62aa3a4abdf6de3f40a20e1743ab]
[FEDORA-2013-1795]
[FEDORA-2013-1826]
[RHSA-2013:0508]
[57539]
[https://bugzilla.redhat.com/show_bug.cgi?id=884601]
[https://fedorahosted.org/sssd/ticket/1781]
[https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.4]
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.
[RHSA-2013:1652]
[https://bugzilla.novell.com/show_bug.cgi?id=798538]
[https://bugzilla.redhat.com/show_bug.cgi?id=903464]
[https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19]
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.
[RHSA-2013:1652]
[https://bugzilla.novell.com/show_bug.cgi?id=796243]
[https://bugzilla.redhat.com/show_bug.cgi?id=903465]
[https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19]
The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.
[RHSA-2013:1652]
[https://bugzilla.novell.com/show_bug.cgi?id=798541]
[https://bugzilla.redhat.com/show_bug.cgi?id=903466]
[https://build.opensuse.org/request/show/149348#diff_headline_coreutils-i18n-patch_diff_action_0_submit_0_19]
The Video module 7.x-2.x before 7.x-2.9 for Drupal, when using the FFmpeg transcoder, allows local users to execute arbitrary PHP code by modifying a temporary PHP file.
[[oss-security] 20130124 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1895234]
[https://drupal.org/node/1896714]
Cross-site scripting (XSS) vulnerability in the User Relationships module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-alpha5 for Drupal allows remote authenticated users with the "administer user relationships" permission to inject arbitrary web script or HTML via a relationship name.
[http://drupalcode.org/project/user_relationships.git/commitdiff/17e94b9]
[http://drupalcode.org/project/user_relationships.git/commitdiff/b9a4739]
[[oss-security] 20130124 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1896272]
[https://drupal.org/node/1896276]
[https://drupal.org/node/1896720]
The Keyboard Shortcut Utility module 7.x-1.x before 7.x-1.1 for Drupal does not properly check node restrictions, which allows (1) remote authenticated users with the "view shortcuts" permission to read nodes or (2) remote authenticated users with the "admin shortcuts" permission to read, edit, or delete nodes via unspecified vectors.
[[oss-security] 20130124 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1896752]
Cross-site scripting (XSS) vulnerability in the Search API Sorts module 7.x-1.x before 7.x-1.4 for Drupal allows remote authenticated users with certain roles to inject arbitrary web script or HTML via unspecified field labels.
[http://drupalcode.org/project/search_api_sorts.git/commitdiff/f6cbf47]
[[oss-security] 20130124 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1896756]
[https://drupal.org/node/1896782]
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=13d2b4d11d69a92574a55bfd985cfb0ca77aebdc]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.9]
[MDVSA-2013:176]
[[oss-security] 20130213 Xen Security Advisory 42 (CVE-2013-0228) - Linux kernel hits general protection if %ds is corrupt for 32-bit PVOPS.]
[USN-1795-1]
[USN-1796-1]
[USN-1797-1]
[USN-1805-1]
[USN-1808-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=906309]
[https://github.com/torvalds/linux/commit/13d2b4d11d69a92574a55bfd985cfb0ca77aebdc]
The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
[https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play]
[https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf]
[https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb]
Stack-based buffer overflow in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to execute arbitrary code via a long quoted method.
[57608]
[https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play]
[https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf]
[https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb]
[36839]
The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information.
[openSUSE-SU-2013:0395]
[SUSE-SU-2013:0674]
[openSUSE-SU-2013:0925]
[DSA-2632]
[[oss-security] 20130205 Xen Security Advisory 43 (CVE-2013-0231) - Linux pciback DoS via not rate limited log messages.]
[57740]
[xen-pcibackenablemsi-dos(81923)]
includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the setDeviceStatusX10 function.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698910]
[http://itsecuritysolutions.org/2013-01-22-ZoneMinder-Video-Server-arbitrary-command-execution-vulnerability/]
[DSA-2640]
[24310]
[[oss-security] 20130128 Re: CVE Request: zoneminder: arbitrary command execution vulnerability]
[http://www.zoneminder.com/forums/viewtopic.php?f=29&t=20771]
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.
Per http://lists.opensuse.org/opensuse-updates/2013-03/msg00000.html
"Affected Products:
openSUSE 12.2"
[http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/]
[openSUSE-SU-2013:0374]
[http://www.metasploit.com/modules/auxiliary/admin/http/rails_devise_pass_reset]
[[oss-security] 20130128 Re: CVE request for 'devise' ruby gem]
[http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html]
[57577]
[https://github.com/Snorby/snorby/issues/261]
Cross-site scripting (XSS) vulnerability in the Twitter widget in Elgg before 1.7.17 and 1.8.x before 1.8.13 allows remote attackers to inject arbitrary web script or HTML via the params[twitter_username] parameter to action/widgets/save.
[http://blog.elgg.org/pg/blog/cash/read/223/elgg-1813-and-1717]
[http://packetstormsecurity.com/files/119903/Elgg-Twitter-Widget-Cross-Site-Scripting.html]
[20130129 XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")]
[[oss-security] 20130128 Re: CVE Request: XSS in Elgg 1.8.12, 1.7.16 (core module "Twitter widget")]
[57569]
[https://github.com/Elgg/Elgg/commit/19dc507c2fccb378be2a44a762edf6c1e7afa334#L0R11]
[https://github.com/Elgg/Elgg/commit/a74a88501c41e89c8bcd7fc650ae2f8cc0a5003d#L2L21]
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
Per: http://cwe.mitre.org/data/definitions/918.html
'CWE-918: Server-Side Request Forgery (SSRF)'
[http://codex.wordpress.org/Version_3.5.1]
[http://core.trac.wordpress.org/changeset/23330]
[http://wordpress.org/news/2013/01/wordpress-3-5-1/]
[http://www.acunetix.com/blog/web-security-zone/wordpress-pingback-vulnerability/]
[https://bugzilla.redhat.com/show_bug.cgi?id=904120]
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.
[http://codex.wordpress.org/Version_3.5.1]
[http://core.trac.wordpress.org/changeset/23317]
[http://core.trac.wordpress.org/changeset/23322]
[http://wordpress.org/news/2013/01/wordpress-3-5-1/]
[https://bugzilla.redhat.com/show_bug.cgi?id=904121]
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.
[http://codex.wordpress.org/Version_3.5.1]
[http://wordpress.org/news/2013/01/wordpress-3-5-1/]
[https://bugzilla.redhat.com/show_bug.cgi?id=904122]
[https://github.com/moxiecode/plupload/commit/2d746ee9083c184f1234d8fed311e89bdd1b39e5]
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699267]
[http://svn.ircd-hybrid.org:8000/viewcvs.cgi/ircd-hybrid/trunk/src/hostmask.c?r1=1786&r2=1785&pathrev=1786]
[DSA-2618]
[24951]
[MDVSA-2013:093]
[[oss-security] 20130129 ircd-hybrid: Denial of service vulnerability in hostmask.c:try_parse_v4_netmask()]
[57610]
[ircdhybrid-tryparsev4netmask-dos(81695)]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0055]
Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.
[http://cxf.apache.org/cve-2013-0239.html]
[http://packetstormsecurity.com/files/120214/Apache-CXF-WS-Security-UsernameToken-Bypass.html]
[RHSA-2013:0749]
[20130208 New security advisories for Apache CXF]
[http://svn.apache.org/viewvc?view=revision&revision=1438424]
[57876]
[apachecxf-username-tokens-sec-bypass(81981)]
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.
Per http://www.ubuntu.com/usn/usn-1779-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[openSUSE-SU-2013:0301]
[USN-1779-1]
[https://bugzilla.gnome.org/show_bug.cgi?id=693214]
[https://bugzilla.redhat.com/show_bug.cgi?id=894352]
[https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1]
[https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f]
[https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e]
[[gnome-announce-list] 20130304 GNOME Online Accounts 3.6.3 released]
The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex. NOTE: some of these details are obtained from third party information.
Per https://rhn.redhat.com/errata/RHSA-2013-0218.html
Affected Products:
Red Hat Enterprise Linux Desktop (v. 6)
Red Hat Enterprise Linux Server (v. 6)
Red Hat Enterprise Linux Workstation (v. 6)
Per http://www.ubuntu.com/usn/USN-1714-1/
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.04 LTS
Ubuntu 11.10
[RHSA-2013:0218]
[MDVSA-2013:138]
[[oss-security] 20130130 CVE request -- qxl: synchronous io guest DoS]
[[oss-security] 20130130 Re: CVE request -- qxl: synchronous io guest DoS]
[USN-1714-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=906032]
[qxl-virtual-spice-dos(81704)]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0036]
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.
[RHSA-2013:0769]
[RHSA-2013:1605]
[http://sourceware.org/bugzilla/show_bug.cgi?id=15078]
[[libc-alpha] 20130129 [PATCH] Fix buffer overrun in regexp matcher]
[MDVSA-2013:163]
[[oss-security] 20130130 Re: CVE Request -- glibc: DoS due to a buffer overrun in regexp matcher by processing multibyte characters]
[57638]
[1028063]
[USN-1991-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0008.html]
[glibc-extendbuffers-dos(81707)]
[GLSA-201503-04]
Cross-site scripting (XSS) vulnerability in Drupal 6.x before 6.28 and 7.x before 7.19, when running with older versions of jQuery that are vulnerable to CVE-2011-4969, allows remote attackers to inject arbitrary web script or HTML via vectors involving unspecified Javascript functions that are used to select DOM elements.
[http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html]
[20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities]
[[oss-security] 20130130 Re: CVE]
[DSA-2776]
[https://drupal.org/SA-CORE-2013-001]
The printer friendly version functionality in the Book module in Drupal 6.x before 6.28 and 7.x before 7.19 does not properly restrict access to node that are part of a book outline, which allows remote authenticated users with the "access printer-friendly version" permission to read node titles and possibly node content via unspecified vectors.
[http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html]
[20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities]
[[oss-security] 20130130 Re: CVE]
[DSA-2776]
[https://drupal.org/SA-CORE-2013-001]
[drupal-book-title-security-bypass(81380)]
The Image module in Drupal 7.x before 7.19, when a private file system is used, does not properly restrict access to derivative images, which allows remote attackers to read derivative images of otherwise restricted images via unspecified vectors.
[http://packetstormsecurity.com/files/119598/Drupal-Core-6.x-7.x-Cross-Site-Scripting-Access-Bypass.html]
[20130116 [Security-news] SA-CORE-2013-001 - Drupal core - Multiple vulnerabilities]
[[oss-security] 20130130 Re: CVE]
[https://drupal.org/SA-CORE-2013-001]
OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.
Per http://www.ubuntu.com/usn/USN-1715-1/
A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10 Ubuntu 12.04 LTS
[FEDORA-2013-2168]
[RHSA-2013:0253]
[57747]
[USN-1715-1]
[https://bugs.launchpad.net/keystone/+bug/1098307]
[https://bugzilla.redhat.com/show_bug.cgi?id=906171]
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
[20130306 [SECURITY] CVE-2013-0248 Apache Commons FileUpload - Insecure examples]
[HPSBMU03409]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[58326]
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.
[http://blog.volema.com/curl-rce.html]
[http://curl.haxx.se/docs/adv_20130206.html]
[APPLE-SA-2013-10-22-3]
[FEDORA-2013-2098]
[http://nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/]
[http://packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html]
[http://packetstormsecurity.com/files/120170/Slackware-Security-Advisory-curl-Updates.html]
[24487]
[http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html]
[57842]
[1028093]
[USN-1721-1]
The init_nss_hash function in exec/totemcrypto.c in Corosync 2.0 before 2.3 does not properly initialize the HMAC key, which allows remote attackers to cause a denial of service (crash) via a crafted packet.
Per: http://cwe.mitre.org/data/definitions/665.html
"CWE-665: Improper Initialization"
[[oss-security] 20130201 CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used]
[[oss-security] 20130201 Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used]
[[oss-security] 20130201 Re: Re: CVE Request -- Corosync (X < 2.0.3): Remote DoS due improper HMAC initialization and improper junk filtering when different encryption keys used]
[https://github.com/corosync/corosync/commit/b3f456a8ceefac6e9f2e9acc2ea0c159d412b595]
Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699625]
[[oss-security] 20130203 Re: CVE id request: latd]
[[oss-security] 20130205 Re: CVE id request: latd]
boost::locale::utf::utf_traits in the Boost.Locale library in Boost 1.48 through 1.52 does not properly detect certain invalid UTF-8 sequences, which might allow remote attackers to bypass input validation protection mechanisms via crafted trailing bytes.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699649]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699650]
[FEDORA-2013-2420]
[FEDORA-2013-2448]
[http://www.boost.org/users/news/boost_locale_security_notice.html]
[MDVSA-2013:065]
[[oss-security] 20130203 Re: CVE id request: boost]
[57675]
[USN-1727-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=907481]
[https://svn.boost.org/trac/boost/ticket/7743]
The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack.
[RHSA-2013:0700]
[https://bugzilla.redhat.com/show_bug.cgi?id=917084]
[[pulsar-commits] 20190416 [GitHub] [pulsar] one70six opened a new issue #4057: Security Vulnerabilities - Black Duck Scan - Pulsar v.2.3.1]
[https://maven.apache.org/security.html]
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.
[openSUSE-SU-2013:0403]
[openSUSE-SU-2013:0404]
[openSUSE-SU-2013:0411]
[[qt-announce] 20130205 [Announce] [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable]
[RHSA-2013:0669]
[https://bugzilla.redhat.com/show_bug.cgi?id=907425]
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
[FEDORA-2013-2123]
[openSUSE-SU-2013:0318]
[openSUSE-SU-2013:0319]
[RHSA-2013:1475]
[DSA-2630]
[MDVSA-2013:142]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/docs/8.3/static/release-8-3-23.html]
[http://www.postgresql.org/docs/8.4/static/release-8-4-16.html]
[http://www.postgresql.org/docs/9.0/static/release-9-0-12.html]
[http://www.postgresql.org/docs/9.1/static/release-9-1-8.html]
[http://www.postgresql.org/docs/9.2/static/release-9-2-3.html]
[57844]
[USN-1717-1]
[https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index]
[https://bugzilla.redhat.com/show_bug.cgi?id=907892]
[postgresql-enumrecv-dos(81917)]
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Per http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/
Affected versions
All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 383
All ruby 2.0 versions prior to ruby 2.0.0 rc2 or prior to trunk revision 39102
[http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2]
[SUSE-SU-2013:0647]
[openSUSE-SU-2013:0303]
[RHSA-2013:0548]
[RHSA-2013:0686]
[RHSA-2013:0701]
[RHSA-2013:0728]
[http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/]
[USN-1733-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=907820]
[https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60]
The email2image module 6.x-1.x and 6.x-2.x for Drupal does not properly restrict access to nodes, which allows remote attackers to read images of user email addresses and email fields.
[http://drupal.org/node/1903264]
[[oss-security] 20130204 Re: CVE request for Drupal contributed modules]
The Google Authenticator login (ga_login) module 7.x before 7.x-1.3 for Drupal, when multi-factor authentication is enabled, allows remote attackers to bypass authentication for accounts without an associated Google Authenticator token by logging in with the username.
[http://drupal.org/node/1902102]
[http://drupal.org/node/1903282]
[http://drupalcode.org/project/ga_login.git/commitdiff/50b032d]
[[oss-security] 20130204 Re: CVE request for Drupal contributed modules]
Cross-site scripting (XSS) vulnerability in the Boxes module 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with administer or edit boxes permissions to inject arbitrary web script or HTML via the subject parameter.
[http://drupal.org/node/1897016]
[http://drupal.org/node/1903300]
[http://drupalcode.org/project/boxes.git/commitdiff/456ff8e]
[[oss-security] 20130204 Re: CVE request for Drupal contributed modules]
[57642]
Unspecified vulnerability in the Drush Debian Packaging module for Drupal allows local users to obtain database credentials via unknown vectors.
[http://drupal.org/node/1903324]
[[oss-security] 20130204 Re: CVE request for Drupal contributed modules]
(1) installer/basedefs.py and (2) modules/ospluginutils.py in PackStack allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.
Per http://rhn.redhat.com/errata/RHSA-2013-0595.html these are the affected products:
Red Hat OpenStack Essex
Red Hat OpenStack Folsom
[RHSA-2013:0595]
[https://bugzilla.redhat.com/show_bug.cgi?id=908101]
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."
[openSUSE-SU-2013:0462]
[http://rack.github.com/]
[https://bugzilla.redhat.com/show_bug.cgi?id=909071]
[https://bugzilla.redhat.com/show_bug.cgi?id=909072]
[https://gist.github.com/rentzsch/4736940]
[https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56]
[https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30]
[https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ]
[https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ]
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
[openSUSE-SU-2013:0462]
[http://rack.github.com/]
[RHSA-2013:0686]
[DSA-2783]
[https://bugzilla.redhat.com/show_bug.cgi?id=909071]
[https://gist.github.com/codahale/f9f3781f7b54985bee94]
[https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07]
[https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11]
[https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J]
[https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ]
[https://groups.google.com/forum/#!msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ]
[https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ]
[https://groups.google.com/forum/#!msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ]
[https://puppet.com/security/cve/cve-2013-0263]
[https://twitter.com/coda/statuses/299732877745197056]
The redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow local users to overwrite arbitrary files via a symlink attack on /tmp/xnbd.log.
[[oss-security] 20130206 CVE request: Insecure default log file path in xNBD]
[[oss-security] 20130206 Re: CVE request: Insecure default log file path in xNBD]
manifests/base.pp in the puppetlabs-cinder module, as used in PackStack, uses world-readable permissions for the (1) cinder.conf and (2) api-paste.ini configuration files, which allows local users to read OpenStack administrative passwords by reading the files.
[RHSA-2013:0595]
[https://bugzilla.redhat.com/show_bug.cgi?id=908581]
[https://github.com/puppetlabs/puppetlabs-cinder/commit/7da792fbd40c0e6eae1ee093aa00e0b177bd2ebc]
The Privileges portion of the web GUI and the XMLRPC API in Apache VCL 2.3.x before 2.3.2, 2.2.x before 2.2.2 and 2.1 allow remote authenticated users with nodeAdmin, manageGroup, resourceGrant, or userGrant permissions to gain privileges, cause a denial of service, or conduct cross-site scripting (XSS) attacks by leveraging improper data validation.
[https://github.com/apache/vcl/commit/56c0f040056d6ad8693b20cfd3351367c2ffeabc#diff-2567a5ec9705eb7ac2c984033e06189d]
[[vcl-commits] 20190729 svn commit: r1863947 - /vcl/site/trunk/content/security.mdtext]
[[vcl-commits] 20190729 svn commit: r1048217 - in /websites/staging/vcl/trunk/content: ./ security.html]
[[www-announce] 20130506 Apache VCL improper input validation]
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c903f0456bc69176912dee6dd25c6a66ee1aed00]
[SUSE-SU-2013:0674]
[openSUSE-SU-2013:1187]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6]
[[oss-security] 20130207 Re: CVE request -- Linux kernel: x86/msr: /dev/cpu/*/msr local privilege escalation]
[https://bugzilla.redhat.com/show_bug.cgi?id=908693]
[https://github.com/torvalds/linux/commit/c903f0456bc69176912dee6dd25c6a66ee1aed00]
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
[APPLE-SA-2013-10-22-5]
[SUSE-SU-2013:0609]
[SUSE-SU-2013:0647]
[openSUSE-SU-2013:0603]
[RHSA-2013:0686]
[RHSA-2013:0701]
[RHSA-2013:1028]
[RHSA-2013:1147]
[http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed]
[http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/]
[[oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]]
[[oss-security] 20130211 Patch update for [CVE-2013-0269]]
[57899]
[SSA:2013-075-01]
[USN-1733-1]
[http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection]
[json-ruby-security-bypass(82010)]
[[rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]]
[https://puppet.com/security/cve/cve-2013-0269]
OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.
[RHSA-2013:0708]
[https://bugs.launchpad.net/keystone/+bug/1099025]
[https://bugzilla.redhat.com/show_bug.cgi?id=909012]
[https://github.com/openstack/keystone/commit/7691276b869a86c2b75631d5bede9f61e030d9d8]
[https://github.com/openstack/keystone/commit/82c87e5638ebaf9f166a9b07a0155291276d6fdc]
[https://launchpad.net/keystone/grizzly/2013.1]
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.
[http://hg.pidgin.im/pidgin/main/rev/a8aef1d340f2]
[SUSE-SU-2013:0388]
[openSUSE-SU-2013:0405]
[http://www.pidgin.im/news/security/?id=65]
[USN-1746-1]
[oval:org.mitre.oval:def:18386]
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.
[http://hg.pidgin.im/pidgin/main/rev/879db2a9a59c]
[SUSE-SU-2013:0388]
[openSUSE-SU-2013:0405]
[openSUSE-SU-2013:0407]
[http://www.pidgin.im/news/security/?id=66]
[57951]
[USN-1746-1]
[oval:org.mitre.oval:def:17474]
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.
[http://hg.pidgin.im/pidgin/main/rev/c31cf8de31cd]
[SUSE-SU-2013:0388]
[openSUSE-SU-2013:0405]
[openSUSE-SU-2013:0407]
[http://www.pidgin.im/news/security/?id=67]
[USN-1746-1]
[oval:org.mitre.oval:def:18340]
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.
[http://hg.pidgin.im/pidgin/main/rev/ad7e7fb98db3]
[SUSE-SU-2013:0388]
[openSUSE-SU-2013:0405]
[openSUSE-SU-2013:0407]
[http://www.pidgin.im/news/security/?id=68]
[USN-1746-1]
[oval:org.mitre.oval:def:18221]
Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://ganglia.info/?p=566]
[[oss-security] 20130208 Re: CVE request: XSS flaws fixed in ganglia]
[58204]
[https://bugzilla.redhat.com/show_bug.cgi?id=892823]
[https://github.com/ganglia/ganglia-web/commit/31d348947419058c43b8dfcd062e2988abd5058e]
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.
[APPLE-SA-2013-06-04-1]
[openSUSE-SU-2013:0462]
[RHSA-2013:0686]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/]
[DSA-2620]
[[oss-security] 20130211 Circumvention of attr_protected [CVE-2013-0276]]
[57896]
[[rubyonrails-security] 20130211 Circumvention of attr_protected [CVE-2013-0276]]
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
[APPLE-SA-2013-06-04-1]
[openSUSE-SU-2013:0462]
[1028109]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/]
[DSA-2620]
[[oss-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277]]
[[rubyonrails-security] 20130211 Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 [CVE-2013-0277]]
[https://puppet.com/security/cve/cve-2013-0277]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1664, CVE-2013-1665. Reason: This candidate is a duplicate of CVE-2013-1664 and/or CVE-2013-1665. Notes: All CVE users should reference CVE-2013-1664 and/or CVE-2013-1665 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).
[RHSA-2013:1635]
[https://bugzilla.redhat.com/show_bug.cgi?id=891922]
[https://github.com/ClusterLabs/pacemaker/commit/564f7cc2a51dcd2f28ab12a13394f31be5aa3c93]
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.
[[oss-security] 20130219 [OSSA 2013-005] Keystone EC2-style authentication accepts disabled user/tenants (CVE-2013-0282)]
[https://bugs.launchpad.net/keystone/+bug/1121494]
[https://launchpad.net/keystone/+milestone/2012.2.4]
[https://launchpad.net/keystone/grizzly/2013.1]
[https://review.openstack.org/#/c/22319/]
[https://review.openstack.org/#/c/22320/]
[https://review.openstack.org/#/c/22321/]
Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.
[[oss-security] 20130213 Some rubygems related CVEs]
[https://newrelic.com/docs/ruby/ruby-agent-security-notification]
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
[[oss-security] 20130213 Some rubygems related CVEs]
[https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately]
The Simple Access Provider in System Security Services Daemon (SSSD) 1.9.0 through 1.9.4, when the Active Directory provider is used, does not properly enforce the simple_deny_groups option, which allows remote authenticated users to bypass intended access restrictions.
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=910938]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=26590d31f492dbbd36be6d0bde46a4bd3b221edb]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6569d57e3bc168e6e83d70333b48c5cb43aa04c4]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=6837eee3f7f81c0ee454d3718d67d7f3cc6b48ef]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=754b09b5444e6da88ed58d6deaed8b815e268b6b]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=7619be9f6bf649665fcbeee9e6b120f9f9cba2a5]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=8b8019fe3dd1564fba657e219ec20ff816c7ffdb]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=b63830b142053f99bfe954d4be5a2b0f68ce3a93]
[http://git.fedorahosted.org/cgit/sssd.git/patch/?id=c0bca1722d6f9dfb654ad78397be70f79ff39af1]
[openSUSE-SU-2013:0559]
[RHSA-2013:0663]
[1028317]
[58593]
[[sssd-devel] 20130319 [SSSD] A security bug in SSSD 1.9 (CVE-2013-0287)]
nss-pam-ldapd before 0.7.18 and 0.8.x before 0.8.11 allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code by performing a name lookup on an application with a large number of open file descriptors, which triggers a stack-based buffer overflow related to incorrect use of the FD_SET macro.
[http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=7867b93f9a7c76b96f1571cddc1de0811134bb81]
[http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=abf03bc54032beeff95b1b8634cc005137e11f32]
[http://arthurdejong.org/git/nss-pam-ldapd/commit/?id=f266f05f20afe73e89c3946a7bd60bd7c5948e1b]
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=690319]
[[nss-pam-ldapd-announce] 20130218 nss-pam-ldapd security advisory (CVE-2013-0288)]
[FEDORA-2013-2754]
[openSUSE-SU-2013:0522]
[openSUSE-SU-2013:0524]
[RHSA-2013:0590]
[DSA-2628]
[MDVSA-2013:106]
[[oss-security] 20130218 CVE-2013-0288 nss-pam-ldapd: FD_SET array index error, leading to stack-based buffer overflow]
[58007]
[https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0288]
[nsspamldapd-fdsetsize-bo(82175)]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0071]
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
[FEDORA-2013-2795]
[FEDORA-2013-2758]
[GLSA-201310-02]
[http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb]
[http://sourceforge.net/projects/isync/files/isync/1.0.6/]
[[oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289)]
[57423]
[isync-ssl-info-disc(82232)]
The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=77c1090f94d1b0b5186fb13a1b71b47b1343f87f]
[openSUSE-SU-2013:0951]
[openSUSE-SU-2013:1042]
[http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.8.bz2]
[MDVSA-2013:176]
[[oss-security] 20130214 Re: CVE Request: kernel -- local DOS (endless loop with interrupts disabled)]
[https://bugzilla.redhat.com/show_bug.cgi?id=911473]
[https://github.com/torvalds/linux/commit/77c1090f94d1b0b5186fb13a1b71b47b1343f87f]
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=911658]
[http://cgit.freedesktop.org/dbus/dbus-glib/commit/?id=166978a09cf5edff4028e670b6074215a4c75eca]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[RHSA-2013:0568]
[33614]
[MDVSA-2013:071]
[[oss-security] 20130215 CVE-2013-0292: authentication bypass due to insufficient checks in dbus-glib < 0.100.1]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[57985]
[USN-1753-1]
[https://bugs.freedesktop.org/show_bug.cgi?id=60916]
[dbus-message-sender-priv-esc(82135)]
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.
[openSUSE-SU-2013:0540]
[[pigz-announce] 20120728 pigz version 2.2.5 released]
[[oss-security] 20130215 CVE# request: pigz creates temp file with insecure permissions]
[[oss-security] 20130215 Re: CVE# request: pigz creates temp file with insecure permissions]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700608]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) site_name or (2) site_url parameter to apps/external/ajax/setsites.php.
[http://owncloud.org/about/security/advisories/oC-SA-2013-003/]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted iCalendar file to the calendar application, the (2) dir or (3) file parameter to apps/files_pdfviewer/viewer.php, or the (4) mountpoint parameter to /apps/files_external/addMountPoint.php.
[http://owncloud.org/about/security/advisories/oC-SA-2013-003/]
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the timezone for the user via the lat and lng parameters to apps/calendar/ajax/settings/guesstimezone.php, (2) disable or enable the automatic timezone detection via the timezonedetection parameter to apps/calendar/ajax/settings/timezonedetection.php, (3) import user accounts via the admin_export parameter to apps/admin_migrate/settings.php, (4) overwrite user files via the operation parameter to apps/user_migrate/ajax/export.php, or (5) change the authentication server URL via unspecified vectors to apps/user_ldap/settings.php.
[http://owncloud.org/about/security/advisories/oC-SA-2013-004/]
Multiple cross-site request forgery (CSRF) vulnerabilities in ownCloud 4.5.x before 4.5.7 allow remote attackers to hijack the authentication of users for requests that (1) change the default view via the v parameter to apps/calendar/ajax/changeview.php, mount arbitrary (2) Google Drive or (3) Dropbox folders via vectors related to addRootCertificate.php, dropbox.php and google.php in apps/files_external/ajax/, or (4) change the authentication server URL via unspecified vectors to apps/user_webdavauth/settings.php.
[http://owncloud.org/about/security/advisories/oC-SA-2013-004/]
Cross-site request forgery (CSRF) vulnerability in apps/calendar/ajax/settings/settimezone in ownCloud before 4.0.12 allows remote attackers to hijack the authentication of users for requests that change the timezone via the timezone parameter.
[http://owncloud.org/about/security/advisories/oC-SA-2013-004/]
Unspecified vulnerability in ownCloud Server before 4.0.12 allows remote attackers to obtain sensitive information via unspecified vectors related to "inclusion of the Amazon SDK testing suite." NOTE: due to lack of details, it is not clear whether the issue exists in ownCloud itself, or in Amazon SDK.
[http://owncloud.org/about/security/advisories/oC-SA-2013-005/]
Unspecified vulnerability in core/ajax/translations.php in ownCloud before 4.0.12 and 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via unknown vectors. NOTE: this entry has been SPLIT due to different affected versions. The core/settings.php issue is covered by CVE-2013-7344.
[http://owncloud.org/about/security/advisories/oC-SA-2013-006/]
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery (CSRF) vulnerability, but due to lack of details, it is uncertain what the root cause is.
[http://owncloud.org/about/security/advisories/oC-SA-2013-007/]
[http://securite.intrinsec.com/wp-content/uploads/2013/02/ISEC-V2013-01-v-1.0-Owncloud-4.5.4-Arbitrary-calendar-export.pdf]
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.
Per http://www.ubuntu.com/usn/usn-1757-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS"
[RHSA-2013:0670]
[USN-1757-1]
[DSA-2634]
[https://www.djangoproject.com/weblog/2013/feb/19/security/]
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.
[RHSA-2013:0670]
[USN-1757-1]
[DSA-2634]
[https://www.djangoproject.com/weblog/2013/feb/19/security/]
Cross-site scripting (XSS) vulnerability in settings.php in ownCloud before 4.0.12 and 4.5.x before 4.5.7 allows remote administrators to inject arbitrary web script or HTML via the group input field parameter.
[http://owncloud.org/about/security/advisories/oC-SA-2013-003/]
The imap-send command in GIT before 1.8.1.4 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701586]
[APPLE-SA-2013-09-18-3]
[openSUSE-SU-2013:0380]
[openSUSE-SU-2013:0382]
[[ANNOUNCE] 20130220 Git v1.8.1.4]
[RHSA-2013:0589]
[http://support.apple.com/kb/HT5937]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[58148]
[1028205]
[https://bugzilla.novell.com/show_bug.cgi?id=804730]
[https://bugzilla.redhat.com/show_bug.cgi?id=909977]
[git-gitimapsend-spoofing(82329)]
[https://raw.github.com/git/git/master/Documentation/RelNotes/1.8.1.4.txt]
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
Per https://access.redhat.com/security/cve/CVE-2013-0309 "This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=027ef6c87853b0a9df53175063028edb4950d476]
[RHSA-2013:0496]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.2]
[[oss-security] 20130219 Re: CVE request -- Linux kernel: mm: thp: pmd_present and PROT_NONE local DoS]
[https://bugzilla.redhat.com/show_bug.cgi?id=912898]
[https://github.com/torvalds/linux/commit/027ef6c87853b0a9df53175063028edb4950d476]
The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.
Per https://access.redhat.com/security/cve/CVE-2013-0310
"This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=89d7ae34cdda4195809a5a987f697a517a2a3177]
[RHSA-2013:0496]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.8]
[[oss-security] 20130219 Re: CVE request -- Linux kernel: net: CIPSO_V4_TAG_LOCAL tag NULL pointer dereference]
[https://bugzilla.redhat.com/show_bug.cgi?id=912900]
[https://github.com/torvalds/linux/commit/89d7ae34cdda4195809a5a987f697a517a2a3177]
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
Per https://access.redhat.com/security/cve/CVE-2013-0311
"This issue did affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 6."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85]
[openSUSE-SU-2013:1187]
[RHSA-2013:0496]
[RHSA-2013:0579]
[RHSA-2013:0882]
[RHSA-2013:0928]
[http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2]
[MDVSA-2013:176]
[[oss-security] 20130219 Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor]
[https://bugzilla.redhat.com/show_bug.cgi?id=912905]
[https://github.com/torvalds/linux/commit/bd97120fc3d1a11f3124c7c9ba1d91f51829eb85]
389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.
[http://directory.fedoraproject.org/wiki/Releases/1.3.0.4]
[RHSA-2013:0628]
[58428]
[https://bugzilla.redhat.com/show_bug.cgi?id=912964]
[https://fedorahosted.org/389/ticket/571]
The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a67adb997419fb53540d4a4f79c6471c60bc69b6]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5]
[[oss-security] 20130220 Re: CVE request - Linux kernel: evm: NULL pointer de-reference flaw]
[https://bugzilla.redhat.com/show_bug.cgi?id=913266]
[https://github.com/torvalds/linux/commit/a67adb997419fb53540d4a4f79c6471c60bc69b6]
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or alter the access controls for portlets.
[RHSA-2013:0613]
[https://bugzilla.redhat.com/show_bug.cgi?id=913327]
The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) attack.
[RHSA-2013:0613]
[https://bugzilla.redhat.com/show_bug.cgi?id=913340]
The Image module in Drupal 7.x before 7.20 allows remote attackers to cause a denial of service (CPU and disk space consumption) via a large number of new derivative requests.
[http://drupal.org/SA-CORE-2013-002]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in the Manager Change for Organic Groups (og_manager_change) module 7.x-2.x before 7.x-2.1 for Drupal might allow remote attackers to inject arbitrary web script or HTML via the username in the new manager autocomplete field.
[http://drupal.org/node/1915408]
[http://drupal.org/node/1916312]
[http://drupalcode.org/project/og_manager_change.git/commitdiff/ab7152b]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified vectors.
[http://drupal.org/node/1916370]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in the Yandex.Metrics module 6.x-1.x before 6.x-1.6 and 7.x-1.x before 7.x-1.5 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors related to the Yandex.Metrica service data.
[http://drupal.org/node/1921340]
[http://drupal.org/node/1921342]
[http://drupal.org/node/1922400]
[http://drupalcode.org/project/yandex_metrics.git/commitdiff/290b718]
[http://drupalcode.org/project/yandex_metrics.git/commitdiff/80bb901]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site request forgery (CSRF) vulnerability in the Taxonomy Manager (taxonomy_manager) module 6.x-2.x before 6.x-2.2 and 7.x-1.x before 7.x-1.0-rc1 for Drupal allows remote attackers to hijack the authentication of users with 'administer taxonomy' permissions via unspecified vectors.
[http://drupal.org/node/1922168]
[http://drupal.org/node/1922170]
[http://drupal.org/node/1922410]
[http://drupalcode.org/project/taxonomy_manager.git/commitdiff/2d05801]
[http://drupalcode.org/project/taxonomy_manager.git/commitdiff/595f1b3]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in Views in the Ubercart Views (uc_views) module 6.x before 6.x-3.3 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
[http://drupal.org/node/1922128]
[http://drupal.org/node/1922416]
[http://drupalcode.org/project/uc_views.git/commitdiff/157d5d3]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in Views in the Ubercart module 7.x-3.x before 7.x-3.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via the full name field.
[http://drupal.org/node/1922136]
[http://drupal.org/node/1922418]
[http://drupalcode.org/project/ubercart.git/commitdiff/f9d69b5]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via the author field.
[http://drupal.org/node/1922424]
[http://drupal.org/node/1922430]
[http://drupal.org/node/1922438]
[http://drupalcode.org/project/ds.git/commitdiff/45d490e]
[http://drupalcode.org/project/ds.git/commitdiff/665c791]
[http://drupalcode.org/project/ds.git/commitdiff/90bcd8f]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site scripting (XSS) vulnerability in the Rendered links formatter in the Menu Reference module 7.x-1.x before 7.x-1.0 for Drupal allows remote authenticated users with the "Administer menus and menu items" permission to inject arbitrary web script or HTML via the menu link title.
[http://drupal.org/node/1922434]
[http://drupal.org/node/1922446]
[http://drupalcode.org/project/menu_reference.git/commitdiff/7e7367d]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Multiple cross-site scripting (XSS) vulnerabilities in the Varnish module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta2 for Drupal allow remote attackers to inject arbitrary web script or HTML via crafted a (1) Watchdog message or (2) admin setting.
[http://drupal.org/node/1922726]
[http://drupal.org/node/1922730]
[http://drupal.org/node/1922756]
[http://drupalcode.org/project/varnish.git/commitdiff/e6726b4]
[http://drupalcode.org/project/varnish.git/commitdiff/f69a62c]
[[oss-security] 20130220 Re: CVE request for Drupal Core and contributed modules]
Cross-site request forgery (CSRF) vulnerability in Jenkins master in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to hijack the authentication of users via unknown vectors.
[RHSA-2013:0638]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb]
[[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16]
[https://bugzilla.redhat.com/show_bug.cgi?id=914875]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16]
Cross-site scripting (XSS) vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[RHSA-2013:0638]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb]
[[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16]
[57994]
[https://bugzilla.redhat.com/show_bug.cgi?id=914876]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16]
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote attackers to bypass the CSRF protection mechanism via unknown attack vectors.
[RHSA-2013:0638]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb]
[[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16]
[https://bugzilla.redhat.com/show_bug.cgi?id=914877]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16]
Unspecified vulnerability in Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to build arbitrary jobs via unknown attack vectors.
[RHSA-2013:0638]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb]
[[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16]
[57994]
[https://bugzilla.redhat.com/show_bug.cgi?id=914878]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16]
Jenkins before 1.502 and LTS before 1.480.3 allows remote authenticated users with write access to cause a denial of service via a crafted payload.
[RHSA-2013:0638]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-02-16.cb]
[[oss-security] 20130220 Re: Jenkins CVE request for Jenkins Security Advisory 2013-02-16]
[57994]
[https://bugzilla.redhat.com/show_bug.cgi?id=914879]
[https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-02-16]
Multiple directory traversal vulnerabilities in ZoneMinder 1.24.x before 1.24.4 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) view, (2) request, or (3) action parameter.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700912]
[DSA-2640]
[[oss-security] 20130220 Re: CVE request: zoneminder: local file inclusion vulnerability]
[[oss-security] 20130221 Re: CVE request: zoneminder: local file inclusion vulnerability]
[http://www.zoneminder.com/forums/viewtopic.php?f=1&t=17979]
[http://www.zoneminder.com/wiki/index.php/Change_History]
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-03-14-1]
[RHSA-2013:0201]
[RHSA-2013:0202]
[RHSA-2013:0203]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/]
[DSA-2613]
[VU#628463]
[[rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3]
[https://puppet.com/security/cve/cve-2013-0333]
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.
[http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html]
[FEDORA-2014-11649]
[FEDORA-2014-11630]
[FEDORA-2014-11677]
[openSUSE-SU-2015:0628]
[http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html]
[70099]
[GLSA-201609-02]
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.
Per http://www.ubuntu.com/usn/USN-1771-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[RHSA-2013:0709]
[[oss-security] 20130226 [OSSA-2013-006] VNC proxy can connect to the wrong VM (CVE-2013-0335)]
[USN-1771-1]
[https://bugs.launchpad.net/nova/+bug/1125378]
[https://review.openstack.org/#/c/22086/]
[https://review.openstack.org/#/c/22758]
[https://review.openstack.org/#/c/22872/]
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.
[58747]
[https://bugzilla.redhat.com/show_bug.cgi?id=913751]
[389directoryserver-cve20130336-dos(83132)]
[https://fedorahosted.org/freeipa/ticket/3539]
[https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=7b45e33400355df44e75576ef7f70a39d163bf8e]
The default configuration of nginx, possibly 1.3.13 and earlier, uses world-readable permissions for the (1) access.log and (2) error.log files, which allows local users to obtain sensitive information by reading the files.
AV:N per http://www.gentoo.org/security/en/glsa/glsa-201310-04.xml
and per http://secunia.com/advisories/55181
[GLSA-201310-04]
[[oss-security] 20130221 nginx world-readable logdir]
[[oss-security] 20130221 Re: CVE request: nginx world-readable logdir]
[[oss-security] 20130224 nginx CVE-2013-0337 world-readable logs]
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.
Per http://www.ubuntu.com/usn/USN-1782-1/ "A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
Ubuntu 8.04 LTS"
Per http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html "http://lists.opensuse.org/opensuse-updates/2013-03/msg00112.html"
[SUSE-SU-2013:1627]
[openSUSE-SU-2013:0552]
[openSUSE-SU-2013:0555]
[SSRT101996]
[DSA-2652]
[MDVSA-2013:056]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[USN-1782-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=912400]
[https://git.gnome.org/browse/libxml2/commit/?id=23f05e0c33987d6605387b300c4be5da2120a7ab]
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.
[SUSE-SU-2013:1627]
[[oss-security] 20130221 CVE Guidance for Libraries and Resource-Consumption DoS]
[[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion]
[[oss-security] 20131028 Re: CVE Request: libxml2 external parsed entities issue]
[[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue]
[[oss-security] 20131029 Re: CVE Request: libxml2 external parsed entities issue]
[DSA-2652]
[[oss-security] 20130412 Re-evaluating expat/libxml2 CVE assignments]
[USN-1904-1]
[USN-1904-2]
[https://bugzilla.redhat.com/show_bug.cgi?id=915149]
[https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f]
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.
[[oss-security] 20130221 CVEs for libxml2 and expat internal and external XML entity expansion]
[1028213]
[[oss-security] 20130413 Re-evaluating expat/libxml2 CVE assignments]
[58233]
[GLSA-201701-21]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.
[openSUSE-SU-2014:0204]
[[oss-security] 20121205 Re: Linux kernel handling of IPv6 temporary addresses]
[[oss-security] 20130116 Re: Linux kernel handling of IPv6 temporary addresses]
[[oss-security] 20130121 Re: Linux kernel handling of IPv6 temporary addresses]
[RHSA-2013:1449]
[RHSA-2013:1490]
[RHSA-2013:1645]
[[oss-security] 20130222 Re: Linux kernel handling of IPv6 temporary addresses]
[USN-1976-1]
[USN-1977-1]
[USN-2019-1]
[USN-2020-1]
[USN-2021-1]
[USN-2022-1]
[USN-2023-1]
[USN-2024-1]
[USN-2038-1]
[USN-2039-1]
[USN-2050-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=914664]
varnish 3.0.3 uses world-readable permissions for the /var/log/varnish/ directory and the log files in the directory, which allows local users to obtain sensitive information by reading the files. NOTE: some of these details are obtained from third party information.
[[oss-security] 20130222 CVE request: varnish world-readable logdir]
[[oss-security] 20130222 Re: CVE request: varnish world-readable logdir]
[58125]
** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."
[[oss-security] 20130222 Re: Cve request: tomcat world-readable logdir]
[https://bugzilla.redhat.com/show_bug.cgi?id=924841]
The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.
[[oss-security] 20130222 CVE request: webfs world-readable log]
[[oss-security] 20130222 Re: CVE request: webfs world-readable log]
[[oss-security] 20130222 Re: Re: CVE request: webfs world-readable log]
[58126]
[webfs-webfsd-information-disclosure(82356)]
thttpd.c in sthttpd before 2.26.4-r2 and thttpd 2.25b use world-readable permissions for /var/log/thttpd.log, which allows local users to obtain sensitive information by reading the file.
[openSUSE-SU-2013:1862]
[openSUSE-SU-2014:0021]
[http://opensource.dyc.edu/gitweb/?p=sthttpd.git;a=commitdiff;h=d2e186dbd58d274a0dea9b59357edc8498b5388d]
[[oss-security] 20130222 Re: CVE request: sthttpd world-redable logdir]
[https://bugs.gentoo.org/show_bug.cgi?id=458896]
[https://bugzilla.redhat.com/show_bug.cgi?id=924857]
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0a9ab9bdb3e891762553f667066190c1d22ad62b]
[RHSA-2013:0744]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6]
[[oss-security] 20130222 Re: CVE request: Linux kernel: Bluetooth HIDP information disclosure]
[USN-1805-1]
[USN-1808-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=914298]
[https://github.com/torvalds/linux/commit/0a9ab9bdb3e891762553f667066190c1d22ad62b]
tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.
[[oss-security] 20130222 CVE-2013-0350 for pktstat: writes content from TCP streams to public readable file /tmp/smtp.log]
[https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701211]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57720]
[TA13-032A]
[oval:org.mitre.oval:def:16703]
[oval:org.mitre.oval:def:19199]
[oval:org.mitre.oval:def:19439]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Content Management.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[57365]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 allows remote attackers to affect integrity via unknown vectors related to Enterprise Configuration Management.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Policy Framework.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1, and EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3, allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity, related to PIA Core Technology.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1 and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Resource Manager.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the APM - Application Performance Management component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Business Transaction Management.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Application Performance Management (APM) component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Business Transaction Management, a different vulnerability than CVE-2013-0396.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0366.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
'Oracle Database Mobile Server was formerly known as Oracle Database Lite for 10g.'
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0363 and CVE-2013-0364.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0362 and CVE-2013-0364.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2013-0362 and CVE-2013-0363.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Mobile Server component in Oracle Database Mobile/Lite Server (formerly Oracle Database Lite) 10.3.0.3 and 11.1.0.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2013-0361.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Partition.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:17077]
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:17255]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Query.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability, related to MyISAM.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16451]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 11.1.0.1 and 12.1.0.1; EM DB Control 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[57378]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Distributed/Cross DB Features.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Enterprise Manager Base Platform component in Oracle Enterprise Manager Grid Control EM Base Platform 10.2.0.5 and 11.1.0.1; EM DB Control 10.2.0.3, 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3; and EM Plugin for DB 12.1.0.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Database Cloning.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.1.28 and earlier, allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Server Replication.
[RHSA-2013:0219]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:17175]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Diagnostics.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Applications Technology Stack component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Client System Analyzer.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Siebel Calendar, a different vulnerability than CVE-2013-0379.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Siebel CRM component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via unknown vectors related to Siebel Calendar, a different vulnerability than CVE-2013-0378.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Payroll component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to View Payslip.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle CRM Technical Foundation component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Application Framework.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Marketing component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Campaign Management.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote attackers to affect availability via unknown vectors related to Server Locking.
[RHSA-2013:0219]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16758]
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Information Schema.
[RHSA-2013:0219]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16632]
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows local users to affect confidentiality and integrity via unknown vectors related to Server Replication.
[RHSA-2013:0219]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16267]
Unspecified vulnerability in the Server component in Oracle MySQL 5.5.28 and earlier allows remote authenticated users to affect availability via unknown vectors related to Stored Procedure.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16835]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to PeopleCode.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft HRMS component in Oracle PeopleSoft Products 9.1 allows remote attackers to affect integrity via unknown vectors related to Mobile Company Directory.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Server component in Oracle MySQL 5.1.66 and earlier, and 5.5.28 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer.
[RHSA-2013:0219]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[USN-1703-1]
[oval:org.mitre.oval:def:16825]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote authenticated users to affect integrity via unknown vectors related to Bookmarkable Pages.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote attackers to affect integrity via unknown vectors related to Portal, a different vulnerability than CVE-2012-5059.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0418.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html
'2. Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8."
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[TA13-043B]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
[MS13-012]
[oval:org.mitre.oval:def:16202]
Unspecified vulnerability in the PeopleSoft HRMS component in Oracle PeopleSoft Products 9.0 and 9.1 allows remote attackers to affect confidentiality via unknown vectors related to Candidate Gateway.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the PeopleSoft PeopleTools component in Oracle PeopleSoft Products 8.51 and 8.52 allows remote authenticated users to affect integrity via unknown vectors related to Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Application Performance Management (APM) component in Oracle Enterprise Manager Grid Control 6.5, 11.1, and 12.1.0.2 allows remote attackers to affect integrity via unknown vectors related to Business Transaction Management, a different vulnerability than CVE-2013-0360.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diagnostics.
[HPSBST02955]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in Oracle Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality via unknown vectors related to Utility/Remote Execution Server (in.rexecd).
[http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html]
[oval:org.mitre.oval:def:19037]
Unspecified vulnerability in Oracle Sun Solaris 9 and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Utility/Umount.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf]
[oval:org.mitre.oval:def:19228]
Unspecified vulnerability in Oracle Sun Solaris 9 and 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Filesystem/cachefs.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf]
[oval:org.mitre.oval:def:19308]
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to execute arbitrary code via vectors related to AWT, as demonstrated by Ben Murphy during a Pwn2Own competition at CanSecWest 2013. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to invocation of the system class loader by the sun.awt.datatransfer.ClassLoaderObjectInputStream class, which allows remote attackers to bypass Java sandbox restrictions.
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[SSRT101305]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/31c782610044]
[SUSE-SU-2013:0814]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[MDVSA-2013:145]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[USN-1806-1]
[TA13-107A]
[http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/]
[https://bugzilla.redhat.com/show_bug.cgi?id=920245]
[oval:org.mitre.oval:def:16297]
[oval:org.mitre.oval:def:19463]
[oval:org.mitre.oval:def:19641]
[https://twitter.com/thezdi/status/309784608508100608]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Heap-based buffer overflow in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via unspecified vectors related to JavaFX, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013.
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[RHSA-2013:0757]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[TA13-107A]
[http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/]
[oval:org.mitre.oval:def:15728]
[https://twitter.com/thezdi/status/309484730506698752]
Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect availability via unknown vectors related to Utility.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19196]
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Kernel/Boot.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19194]
Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows remote attackers to affect confidentiality and integrity via vectors related to NFS client mounts and IPv6.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19352]
Unspecified vulnerability in Oracle Sun Solaris 10 allows remote attackers to affect integrity via unknown vectors via vectors related to Kernel/IPsec.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19224]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/DTrace Framework.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf]
[oval:org.mitre.oval:def:19400]
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via vectors related to CPU performance counters drivers.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19124]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38 allows remote attackers to affect confidentiality via vectors related to JMX.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)
Applies to installation process on client deployment of Java."
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57728]
[TA13-032A]
[oval:org.mitre.oval:def:16530]
[oval:org.mitre.oval:def:19114]
[oval:org.mitre.oval:def:19240]
[oval:org.mitre.oval:def:19383]
Unspecified vulnerability in the Agile EDM component in Oracle Supply Chain Products Suite 6.1.1.0, 6.1.2.0, and 6.1.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Base Component - Common Objects.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle Sun Solaris 8, 9, and 10 allows local users to affect confidentiality, integrity, and availability via vectors related to RBAC Configuration.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:18529]
Unspecified vulnerability in Oracle Sun Solaris 8, 9, 10, and 11 allows local users to affect integrity and availability via unknown vectors related to Utility/pax.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:18818]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Remote Execution Service.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19409]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect integrity and availability via unknown vectors related to Utility/ksh93.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Bind/Postinstall script for Bind package.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf]
[oval:org.mitre.oval:def:19370]
Unspecified vulnerability in the Siebel Enterprise Application Integration component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Web Services, a different vulnerability than CVE-2013-2403.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Sun Storage Common Array Manager (CAM) component in Oracle Sun Products Suite 6.9.0 allows remote attackers to affect confidentiality, related to Fault Management System (FMS).
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be triggered using a table header with a crafted "number of fields" value.
Per: http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html#AppendixFMW
'2. Outside In Technology is a suite of software development kits (SDKs). It does not have any particular associated protocol. If the hosting software passes data received over the network to Outside In Technology code, the CVSS score would increase to 6.8.'
[20130117 Secunia Research: Oracle Outside In Technology Paradox Database Handling Buffer Overflow]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[TA13-043B]
[http://www-01.ibm.com/support/docview.wss?uid=swg21660640]
[MS13-012]
[oval:org.mitre.oval:def:16251]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57714]
[TA13-032A]
[oval:org.mitre.oval:def:16247]
[oval:org.mitre.oval:def:19097]
[oval:org.mitre.oval:def:19501]
Unspecified vulnerability in the VirtualBox component in Oracle Virtualization 4.0, 4.1, and 4.2 allows local users to affect integrity and availability via unknown vectors related to Core. NOTE: The previous information was obtained from the January 2013 Oracle CPU. Oracle has not commented on claims from another vendor that this issue is related to an incorrect comparison in the vga_draw_text function in Devices/Graphics/DevVGA.cpp, which can cause VirtualBox to "draw more lines than necessary."
[openSUSE-SU-2013:0231]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html]
[https://bugzilla.novell.com/show_bug.cgi?id=798776]
[oval:org.mitre.oval:def:15763]
[https://www.virtualbox.org/changeset/44055/vbox]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
Per: http://www.oracle.com/technetwork/java/javase/downloads/jdk7-downloads-1880260.html
'Note: JDK and JRE 6, 5.0 and 1.4.2, and Java SE Embedded JRE releases are not affected.'
[http://blog.fireeye.com/research/2013/01/happy-new-year-from-new-java-zero-day.html]
[http://blog.fuseyism.com/index.php/2013/01/15/security-icedtea-2-1-4-2-2-4-2-3-4-released/]
[http://immunityproducts.blogspot.ca/2013/01/confirmed-java-only-fixed-one-of-two.html]
[http://krebsonsecurity.com/2013/01/zero-day-java-exploit-debuts-in-crimeware/]
[http://labs.alienvault.com/labs/index.php/2013/new-year-new-java-zeroday/]
[openSUSE-SU-2013:0199]
[http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html]
[RHSA-2013:0156]
[RHSA-2013:0165]
[20130110 [SE-2012-01] 'Fix' for Issue 32 exploited by new Java 0-day code]
[VU#625617]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/alert-cve-2013-0422-1896849.html]
[USN-1693-1]
[TA13-010A]
[https://partners.immunityinc.com/idocs/Java%20MBeanInstantiator.findClass%200day%20Analysis.pdf]
[https://threatpost.com/en_us/blogs/nasty-new-java-zero-day-found-exploit-kits-already-have-it-011013]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0018]
[https://www-304.ibm.com/connections/blogs/PSIRT/entry/oracle_java_7_security_manager_bypass_vulnerability_cve_2013_04224?lang=en_us]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57716]
[TA13-032A]
[oval:org.mitre.oval:def:16476]
[oval:org.mitre.oval:def:18869]
[oval:org.mitre.oval:def:19425]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via vectors related to RMI. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to cross-site scripting (XSS) in the sun.rmi.transport.proxy CGIHandler class that does not properly handle error messages in a (1) command or (2) port number.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e173569e1e7]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57715]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=906813]
[oval:org.mitre.oval:def:16519]
[oval:org.mitre.oval:def:19131]
[oval:org.mitre.oval:def:19423]
[oval:org.mitre.oval:def:19522]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0428 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907344]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57709]
[TA13-032A]
[oval:org.mitre.oval:def:16058]
[oval:org.mitre.oval:def:19483]
[oval:org.mitre.oval:def:19502]
[oval:org.mitre.oval:def:19503]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0428. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect "access control checks" in the logging API that allow remote attackers to bypass Java sandbox restrictions.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907346]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce105dd2e4de]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57711]
[TA13-032A]
[oval:org.mitre.oval:def:15888]
[oval:org.mitre.oval:def:19261]
[oval:org.mitre.oval:def:19471]
[oval:org.mitre.oval:def:19484]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Libraries. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to interrupt certain threads that should not be interrupted.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907455]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/87d135824bdf]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57724]
[TA13-032A]
[oval:org.mitre.oval:def:16013]
[oval:org.mitre.oval:def:18641]
[oval:org.mitre.oval:def:19245]
[oval:org.mitre.oval:def:19488]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2013-0425 and CVE-2013-0426. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "incorrect checks for proxy classes" in the Reflection API.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c9534e095b37]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57713]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=907207]
[oval:org.mitre.oval:def:16496]
[oval:org.mitre.oval:def:19474]
[oval:org.mitre.oval:def:19480]
[oval:org.mitre.oval:def:19491]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue involves the creation of a single PresentationManager that is shared across multiple thread groups, which allows remote attackers to bypass Java sandbox restrictions.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907460]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/c1ed8145c1b8]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57710]
[TA13-032A]
[oval:org.mitre.oval:def:16649]
[oval:org.mitre.oval:def:19300]
[oval:org.mitre.oval:def:19342]
[oval:org.mitre.oval:def:19457]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the installation process of the client.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to installation process on client deployment of Java."
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57722]
[TA13-032A]
[oval:org.mitre.oval:def:16600]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/]
[http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:0237]
[RHSA-2013:0247]
[20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
[20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
[GLSA-201406-32]
[http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
[TA13-032A]
[oval:org.mitre.oval:def:16579]
[oval:org.mitre.oval:def:19418]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient clipboard access premission checks."
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907219]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/e46d557465da]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57727]
[TA13-032A]
[oval:org.mitre.oval:def:16567]
[oval:org.mitre.oval:def:19181]
[oval:org.mitre.oval:def:19426]
[oval:org.mitre.oval:def:19489]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect integrity via unknown vectors related to Networking. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to avoid triggering an exception during the deserialization of invalid InetSocketAddress data.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ab011765c4e8]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57719]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=907456]
[oval:org.mitre.oval:def:16537]
[oval:org.mitre.oval:def:19405]
[oval:org.mitre.oval:def:19459]
[oval:org.mitre.oval:def:19468]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAXP. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the public declaration of the loadPropertyFile method in the JAXP FuncSystemProperty class, which allows remote attackers to obtain sensitive information.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907453]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jaxp/rev/91fcc41a0b4b]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57730]
[TA13-032A]
[oval:org.mitre.oval:def:16528]
[oval:org.mitre.oval:def:19272]
[oval:org.mitre.oval:def:19430]
[oval:org.mitre.oval:def:19505]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality via vectors related to JAX-WS. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper restriction of com.sun.xml.internal packages and "Better handling of UI elements."
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906892]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/c1fa21042291]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57729]
[TA13-032A]
[oval:org.mitre.oval:def:16489]
[oval:org.mitre.oval:def:19078]
[oval:org.mitre.oval:def:19520]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:15723]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client and server deployment of Java. This vulnerability can be exploited through untrusted Java Web Start applications and untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service."
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:0237]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16492]
[oval:org.mitre.oval:def:19403]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57708]
[TA13-032A]
[oval:org.mitre.oval:def:16582]
[oval:org.mitre.oval:def:19288]
[oval:org.mitre.oval:def:19485]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16705]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 7, allows remote attackers to affect availability via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to CPU consumption in the SSL/TLS implementation via a large number of ClientHello packets that are not properly handled by (1) ClientHandshaker.java and (2) ServerHandshaker.java.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to server deployments of JSSE."
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/5c1e8b779c65]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57712]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=859140]
[oval:org.mitre.oval:def:16558]
[oval:org.mitre.oval:def:19229]
[oval:org.mitre.oval:def:19285]
[oval:org.mitre.oval:def:19397]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-1476 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via certain methods that should not be serialized, aka "missing serialization restriction."
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907458]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/307ddc7799c7]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57692]
[TA13-032A]
[oval:org.mitre.oval:def:16566]
[oval:org.mitre.oval:def:19266]
[oval:org.mitre.oval:def:19289]
[oval:org.mitre.oval:def:19509]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=906899]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57687]
[TA13-032A]
[oval:org.mitre.oval:def:16035]
[oval:org.mitre.oval:def:18597]
[oval:org.mitre.oval:def:19126]
[oval:org.mitre.oval:def:19434]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality and integrity via vectors related to JSSE. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to incorrect validation of Diffie-Hellman keys, which allows remote attackers to conduct a "small subgroup attack" to force the use of weak session keys or obtain sensitive information about the private key.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to server deployments of JSSE."
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/496bced2d275]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57702]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=907340]
[oval:org.mitre.oval:def:15832]
[oval:org.mitre.oval:def:19010]
[oval:org.mitre.oval:def:19382]
[oval:org.mitre.oval:def:19437]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient checks for cached results" by the Java Beans MethodFinder, which might allow attackers to access methods that should only be accessible to privileged code.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907218]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/ce04db4aba39]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:0237]
[RHSA-2013:0247]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16614]
[oval:org.mitre.oval:def:19349]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to an improper check of "privileges of the code" that bypasses the sandbox.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6527ae06da69]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57689]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=906900]
[oval:org.mitre.oval:def:16680]
[oval:org.mitre.oval:def:19282]
[oval:org.mitre.oval:def:19304]
[oval:org.mitre.oval:def:19372]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57699]
[TA13-032A]
[oval:org.mitre.oval:def:16353]
[oval:org.mitre.oval:def:19048]
[oval:org.mitre.oval:def:19102]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16240]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect integrity via unknown vectors related to Libraries.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[RHSA-2013:0237]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16264]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 allows remote attackers to affect confidentiality via unknown vectors related to Deployment.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:0237]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16610]
[oval:org.mitre.oval:def:19123]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and 5.0 through Update 38, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to improper checks of "access control context" in the JMX RequiredModelMBean class.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/6e0d9f4942af]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57703]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=906911]
[oval:org.mitre.oval:def:16550]
[oval:org.mitre.oval:def:19286]
[oval:org.mitre.oval:def:19363]
[oval:org.mitre.oval:def:19572]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
SQL injection vulnerability in IBM Maximo Asset Management 6.2 through 6.2.8 and 7.1 through 7.1.1.12 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[IV24726]
[http://www-01.ibm.com/support/docview.wss?uid=swg21651085]
[maximo-cve20130451-sql-injection(80967)]
Cross-site request forgery (CSRF) vulnerability in the Software Use Analysis (SUA) application before 1.3.3 in IBM Tivoli Endpoint Manager 8.2 allows remote attackers to hijack the authentication of arbitrary users via a web site that contains crafted Flash Action Message Format (AMF) messages.
[IV38145]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631350]
[tem-sua-csrf(80968)]
Cross-site scripting (XSS) vulnerability in Web Reports in IBM Tivoli Endpoint Manager (TEM) before 8.2.1372 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www.ibm.com/support/docview.wss?uid=swg21631351]
[IV37766]
[tem-web-reports-xss(80969)]
The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.
[http://www.ibm.com/support/docview.wss?uid=ssg1S1004289]
[USN-1802-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=928419]
[https://bugzilla.samba.org/show_bug.cgi?id=8738]
[storwize-cifs-incorrect-permissions(80970)]
[[samba-announce] 20120625 [Announce] Samba 3.6.6 Available for Download]
[https://www.samba.org/samba/security/CVE-2013-0454]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2.4 and Sterling File Gateway allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[IC92888]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to hijack sessions via a modified cookie path.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130456-hijack(80972)]
Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a uisessionid.
[IV20590]
[http://www-01.ibm.com/support/docview.wss?uid=swg21625624]
[mam-uisessionid-xss(81011)]
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2, when login security is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21622444]
[PM71139]
[was-admin-login-xss(81012)]
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21622444]
[PM72536]
[was-admin-type-xss(81013)]
Cross-site request forgery (CSRF) vulnerability in the portlet subsystem in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 and 7.0 before 7.0.0.27 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences.
[http://www.ibm.com/support/docview.wss?uid=swg21622444]
[PM72275]
[was-admin-portlet-csrf(81014)]
Cross-site scripting (XSS) vulnerability in the virtual member manager (VMM) administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.27, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21622444]
[PM71389]
[was-admin-vmm-xss(81015)]
Unspecified vulnerability in IBM WebSphere Application Server (WAS) 6.1, 7.0 before 7.0.0.27, 8.0, and 8.5 has unknown impact and attack vectors.
[http://www.ibm.com/connections/blogs/PSIRT/entry/security_vulnerabilities_fixed_in_ibm_websphere_application_server_7_0_0_2785]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, CVE-2013-0475, and CVE-2013-0567.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130463-infodisc(81017)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Eclipse Help System (IEHS) 3.4.3 and 3.6.2, as used in IBM SPSS Data Collection 6.0, 6.0.1, and 7.0, allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
[60246]
[http://www-01.ibm.com/support/docview.wss?uid=swg21637954]
[iehs-cve20130464-xss(81060)]
Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
[LI77155]
[http://www-01.ibm.com/support/docview.wss?uid=swg21623324]
[was-castiron-security-bypass(81061)]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of an error message.
[IC89383]
[http://www-01.ibm.com/support/docview.wss?uid=swg21623316]
[wmb-wsdl-xss(81062)]
IBM Eclipse Help System (IEHS), as used in IBM Data Studio 3.1 and 3.1.1 and other products, allows remote authenticated users to read source code via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21625573]
[iehs-source-disclosure(81102)]
Cross-site scripting (XSS) vulnerability in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2013-2983.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130468-xss(81334)]
HTTPD in IBM Netezza Performance Portal 1.0.2 allows remote authenticated users to list application directories containing asset files via a direct request to a directory URI, as demonstrated by listing image files.
[http://www-01.ibm.com/support/docview.wss?uid=swg21631945]
[netezza-cve20130470-info-disclosure(81336)]
The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.
[IC87331]
[http://www-01.ibm.com/support/docview.wss?uid=swg21624135]
[tsm-scheduler-dos(81215)]
The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access, and consequently obtain unspecified server access, via unknown vectors.
[IC87210]
[http://www-01.ibm.com/support/docview.wss?uid=swg21624118]
[tsm-gui-unauth-access(81216)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow remote attackers to inject arbitrary web script or HTML via a crafted report.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631304]
[appscan-cve20130473-xss(81337)]
The Manual Explore browser plug-in in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to discover test Platform Authentication credentials via a crafted web site.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631304]
[appscan-manual-explore-csrf(81338)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0567.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130475-infodisc(81403)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to inject arbitrary FTP commands via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130476-ftp(81405)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allow remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21624952]
[mdm-web-content-spoofing(81481)]
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21624952]
[mdm-web-xss(81482)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 do not properly restrict file types and extensions, which allows remote authenticated users to bypass intended access restrictions via a crafted filename.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130479-filehandling(81547)]
The console in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allows remote attackers to read stack traces by triggering (1) an error or (2) an exception.
[http://www-01.ibm.com/support/docview.wss?uid=swg21627986]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-ui-info-disclosure(81546)]
IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 through 8.5.0.2 and WebSphere Message Broker 6.1, 7.0 through 7.0.0.5, and 8.0 through 8.0.0.2, when WS-Security is used, allows remote attackers to spoof the signatures of messages via a crafted SOAP message, related to a "Signature Wrap attack," a different vulnerability than CVE-2011-1377 and CVE-2013-0489.
[IC88185]
[PM76582]
[PM86026]
[http://www-01.ibm.com/support/docview.wss?uid=swg21634646]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635474]
[was-wssecurity-spoofing(81548)]
The login component in SOAP Gateway in IBM IMS Enterprise Suite 1.1, 2.1, and 2.2 uses cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network.
[http://www-01.ibm.com/support/docview.wss?uid=swg21631537]
[ims-insecure-login(81533)]
The server process in IBM Cognos TM1 10.1.x before 10.1.1 FP1 allows remote attackers to cause a denial of service (daemon crash) via an undocumented API call that triggers the transmission of unexpected data.
[http://www-01.ibm.com/support/docview.wss?uid=swg21637655]
[tm1-undocumented-api(81612)]
Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown impact and attack vectors related to Class Libraries.
[SUSE-SU-2013:0701]
[http://www.ibm.com/developerworks/java/jdk/aix/142_64/fixes.html#SR13FP16]
[http://www.ibm.com/developerworks/java/jdk/aix/j532/fixes.html#SR16FP1]
[http://www.ibm.com/developerworks/java/jdk/aix/j664/Java6_64.fixes.html#SR13FP1]
[http://www.ibm.com/developerworks/java/jdk/aix/j732/Java7.fixes.html#SR4FP1]
[https://bugzilla.redhat.com/show_bug.cgi?id=950072]
Memory leak in the HTTP server in IBM Domino 8.5.x allows remote attackers to cause a denial of service (memory consumption and daemon crash) via GET requests, aka SPR KLYH92NKZY.
[JVN#51305555]
[JVNDB-2013-000030]
[http://www-01.ibm.com/support/docview.wss?uid=swg21627597]
[domino-get-dos(81812)]
The Java Console in IBM Domino 8.5.x allows remote authenticated users to hijack temporary credentials by leveraging knowledge of configuration details, aka SPR KLYH8TNNDN.
[http://www-01.ibm.com/support/docview.wss?uid=swg21627597]
[domino-controller-auth-bypass(81852)]
Cross-site scripting (XSS) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21627597]
[domino-webadmin-xss(81853)]
Cross-site request forgery (CSRF) vulnerability in webadmin.nsf (aka the Web Administrator client) in IBM Domino 8.5.x allows remote authenticated users to hijack the authentication of administrators.
[http://www-01.ibm.com/support/docview.wss?uid=swg21627597]
[domino-webadmin-csrf(81854)]
Unspecified vulnerability in IBM InfoSphere Guardium S-TAP 8.1 for DB2 on z/OS allows local users to gain privileges via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626276]
[ibm-zos-priv-esc(81948)]
Cross-site scripting (XSS) vulnerability in IBM Informix Open Admin Tool (OAT) 2.x and 3.x before 3.11.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21645601]
[informix-oat-cve20130492-xss(82007)]
IBM Sterling B2B Integrator 5.0 and 5.1 allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted HTTP (1) Range or (2) Request-Range header.
[IC82726]
[http://www-01.ibm.com/support/docview.wss?uid=swg21627989]
[sterling-b2b-byte-dos(82009)]
Cross-site scripting (XSS) vulnerability in the echo functionality on IBM WebSphere DataPower SOA appliances with firmware 3.8.2, 4.0, 4.0.1, 4.0.2, and 5.0.0 allows remote attackers to inject arbitrary web script or HTML via a SOAP message, as demonstrated by the XML Firewall, Multi Protocol Gateway (MPGW), Web Service Proxy, and Web Token services.
[20130523 SEC Consult SA-20130523-0 :: JavaScript Execution in IBM WebSphere DataPower Services]
[http://www-01.ibm.com/support/docview.wss?uid=swg21637717]
[was-datapower-echo-xss(82221)]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130523-0_IBM_Xi50_Echo-WebService_Xss_in_Xml_v10.txt]
IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 does not properly handle device files that are created with the NFS protocol but accessed with a non-NFS protocol, which allows remote authenticated users to obtain sensitive information, modify programs or files, or cause a denial of service (device crash) via a (1) CIFS, (2) HTTPS, (3) SCP, or (4) SFTP operation.
[http://www.ibm.com/support/docview.wss?uid=ssg1S1004430]
[storwize-v7000-cve20130500-crossprotocol(84839)]
The EdrawSoft EDOFFICE.EDOfficeCtrl.1 ActiveX control, as used in Edraw Office Viewer Component, the client in IBM Cognos Disclosure Management (CDM) 10.2.0, and other products, allows remote attackers to read arbitrary files, or download an arbitrary program onto a client machine and execute this program, via a crafted web site.
[http://www.ibm.com/support/docview.wss?uid=swg21627070]
[cdm-edrawsoft-activex(82345)]
Cross-site scripting (XSS) vulnerability in IBM InfoSphere Information Server 8.1, 8.5 through FP3, 8.7 through FP2, and 9.1 allows remote attackers to inject arbitrary web script or HTML via a malformed URL.
[JR45274]
[http://www-01.ibm.com/support/docview.wss?uid=swg21632556]
[infosphere-web-console-xss(82233)]
Cross-site scripting (XSS) vulnerability in the Bookmarks component in IBM Lotus Connections before 4.0 CR3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[LO74182]
[http://www-01.ibm.com/support/docview.wss?uid=swg21634538]
[lotus-connections-reflected-xss(82265)]
Buffer overflow in the broker service in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows attackers to execute arbitrary code via unspecified vectors.
Per: http://www.adobe.com/support/security/bulletins/apsb13-08.html
'Flash Player 11.6.602.168 and earlier versions for Windows
Flash Player 11.6.602.167 and earlier versions for Macintosh
Flash Player 11.2.202.270 and earlier for Linux'
[openSUSE-SU-2013:0359]
[openSUSE-SU-2013:0360]
[SUSE-SU-2013:0373]
[RHSA-2013:0574]
[http://www.adobe.com/support/security/bulletins/apsb13-08.html]
[58184]
IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to conduct XPath injection attacks, and read arbitrary XML files, via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21631302]
[sterling-om-xpath-injection(82339)]
Cross-site scripting (XSS) vulnerability in IBM Sterling Order Management 8.0 before HF127, 8.5 before HF89, 9.0 before HF69, 9.1.0 before FP41, and 9.2.0 before FP13 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[IC90858]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631302]
[sterling-om-address-xss(82341)]
Multiple buffer overflows in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 and 4.0.1 before FP1 allow context-dependent attackers to execute arbitrary code or cause a denial of service via a long line in (1) hrfstable.idx, (2) hrdevice.idx, (3) hrstorage.idx, or (4) lotusmapfile in the SSM Config directory, or (5) .manifest.hive in the main agent directory.
[http://www-01.ibm.com/support/docview.wss?uid=swg21638459]
[netcool-cve20130508-config-bo(82333)]
Buffer overflow in the Transaction MIB agent in IBM Tivoli Netcool System Service Monitors (SSM) and Application Service Monitors (ASM) 4.0.0 before FP14 allows remote attackers to execute arbitrary code via a SQL transaction with a long table name that is not properly handled by a packet decoder.
[http://www-01.ibm.com/support/docview.wss?uid=swg21638183]
[netcool-cve20130509-mib-bo(82334)]
IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 includes a security test that sends session cookies to a specific external server, which allows man-in-the-middle attackers to hijack the test account by capturing these cookies.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[appscan-fwd-info-disclosure(82592)]
Multiple SQL injection vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 allow remote authenticated users to execute arbitrary SQL commands via unspecified parameters.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[appscan-cve20130511-sql-injection(82344)]
Stack-based buffer overflow in the Manual Explore browser plug-in for Firefox in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to cause a denial of service (plug-in crash) via a crafted web page.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631304]
[appscan-fme-dos(82593)]
IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 create a service that lacks " (double quote) characters in the service path, which allows local users to gain privileges via a Trojan horse program, related to an "Unquoted Service Path Enumeration" vulnerability.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631304]
[appscan-svc-path-priv-esc(82594)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does not refuse to be rendered in different-origin frames, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
[http://www-01.ibm.com/support/docview.wss?uid=swg21636369]
[ssp-cve20130518-content-spoofing(83128)]
IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 provides web-server version data in (1) an unspecified page title and (2) an unspecified HTTP header field, which allows remote attackers to obtain potentially sensitive information by reading a version string.
[http://www-01.ibm.com/support/docview.wss?uid=swg21636369]
[ssp-cve20130519-info-disclosure(82654)]
IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allows remote authenticated users to obtain sensitive Java stack-trace information by providing invalid input data.
[http://www-01.ibm.com/support/docview.wss?uid=swg21636369]
[ssp-cve20130520-info-disclosure(83433)]
The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to discover passwords via vectors involving an unspecified operating system communication mechanism for password transmission between Windows and Notes. IBM X-Force ID: 82531.
[ibm-notes-password-retrieval(82531)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21634508]
IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryption algorithm for storefront web requests, which allows remote attackers to obtain sensitive information via a padding oracle attack that targets certain UTF-8 processing of the krypto parameter, and leverages unspecified browser access or traffic-log access.
[http://www.vsecurity.com/advisory/20130619-1.txt]
[http://www.vsecurity.com/resources/advisory/20130619-1/]
[JR46386]
[was-commerce-cve20130523-info-disclosure(82541)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21640597]
Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a shared mail file, aka SPR DKEN8PDNTX.
[http://www-01.ibm.com/support/docview.wss?uid=swg21628658]
[inotes-folder-xss(82542)]
ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch allows remote authenticated users to execute arbitrary commands via shell metacharacters in the (1) count or (2) size parameter.
[http://www.bitcloud.es/2013/08/vulnerabilidad-en-kvms-gcm1632-de-ibm.html]
[http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5093509]
[gcm-cve20130526-command-exec(85367)]
The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not close pages upon the timeout of a session, which allows physically proximate attackers to obtain sensitive administrative-console information by reading the screen of an unattended workstation.
[IC90479]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640356]
[sterling-cve20130527-info-disclosure(82609)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
[IC90478]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640356]
[sterling-cve20130529-info-disclosure(82611)]
The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes it easier for remote attackers to obtain sensitive information by sniffing the network.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640352]
[appscan-cve20130531-weak-ciphersuites(84707)]
Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allows remote attackers to hijack the authentication of arbitrary users for requests that cause a denial of service via malformed HTTP data.
[http://www-01.ibm.com/support/docview.wss?uid=swg21626264]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631304]
[appscan-cve20130532-csrf(82595)]
Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21633620]
[inotes-webmail-xss(82655)]
The Connect client in IBM Sametime 8.5.1, 8.5.1.1, 8.5.1.2, 8.5.2, and 8.5.2.1, as used in the Lotus Notes client and separately, might allow local users to obtain sensitive information by leveraging the persistence of cleartext password strings within process memory.
[http://www-01.ibm.com/support/docview.wss?uid=swg21635218]
[notes-cve20130534-info-disclosure(82656)]
Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21635185]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635545]
[sametime-meeting-multiple-xss(82657)]
ntmulti.exe in the Multi User Profile Cleanup service in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3 before FP5, and 9.0 before IF2 allows local users to gain privileges via vectors that arrange for code to be executed during the next login session of a different user, aka SPR PJOK959J24.
[http://www-01.ibm.com/support/docview.wss?uid=swg21633827]
[notes-cve20130536-code-exec(82658)]
The Enterprise Meeting Server in IBM Lotus Sametime 8.5.2 and 8.5.2.1 allows remote authenticated users to spoof the origin of shared links by leveraging meeting-attendance privileges.
[http://www-01.ibm.com/support/docview.wss?uid=swg21654355]
[sametime-ems-cve20130537-spoof(84840)]
Cross-site scripting (XSS) vulnerability in IBM Lotus Notes 8.x before 8.5.3 FP4 Interim Fix 1 and 9.0 before Interim Fix 1 allows remote attackers to inject arbitrary web script or HTML via a SCRIPT element in an HTML e-mail message, aka SPRs JMOY95BLM6 and JMOY95BN49.
[VU#912420]
[http://www-01.ibm.com/support/docview.wss?uid=swg21633819]
[ibm-notes-javascript-tags(83270)]
An unspecified third-party component in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 uses short session ID values, which makes it easier for remote attackers to hijack sessions, and consequently obtain sensitive information, via a brute-force attack.
[IC92007]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130539-sessionid(82916)]
IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.0.2, when SSL is not enabled, does not properly validate authentication cookies, which allows remote authenticated users to bypass intended access restrictions via an HTTP session.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM81056]
[was-ssl-sec-bypass(82695)]
Buffer overflow in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Windows, when a localOS registry is used in conjunction with WebSphere Identity Manger (WIM), allows local users to cause a denial of service (daemon crash) via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM74909]
[was-cve20130541-dos(82696)]
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via crafted field values.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM81846]
[was-cve20130542-xss(82697)]
IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux, Solaris, and HP-UX, when a Local OS registry is used, does not properly validate user accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM75582]
[was-cve20130543-sec-bypass(82759)]
Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM82468]
[was-cve20130544-dir-traversal(82760)]
Multiple cross-site scripting (XSS) vulnerabilities in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[IV27192]
[IV30187]
[IV40115]
[IV40116]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640752]
[itm-cve20130548-xss(82767)]
Cross-site scripting (XSS) vulnerability in the Web Content Manager - Web Content Viewer Portlet in the server in IBM WebSphere Portal 7.0.0.x through 7.0.0.2 CF22 and 8.0.0.x through 8.0.0.1 CF5, when the IBM Portlet API is used, allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[PM84525]
[http://www-01.ibm.com/support/docview.wss?uid=swg21638984]
[was-portal-cve20130549-xss(82762)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
The Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to cause a denial of service (abend) via a crafted URL.
[IV27192]
[IV30187]
[IV40115]
[IV40116]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635080]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640752]
[itm-cve20130551-dos(82768)]
The client implementation in IBM Sametime 8.5.1 through 8.5.2.1, as used in Sametime Connect client, Sametime Advanced Connect client, Sametime Advanced Web client, and other products, allows remote authenticated users to send commands to individual chat users, or to all participants in a chat room, via a crafted Sametime Instant Message (IM).
[http://www-01.ibm.com/support/docview.wss?uid=swg21633618]
[ibm-sametime-commands(82915)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote attackers to obtain sensitive information about application implementation via unspecified vectors.
[IC90483]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130558-infodisc(83006)]
Unspecified vulnerability in IBM API Management 2.0 before 2.0.0.1 allows remote attackers to access tenant APIs, and consequently obtain sensitive information or modify data, via unknown vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21643847]
[apimgmt-cve20130559-unauth-access(85557)]
Multiple SQL injection vulnerabilities in IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors, a different vulnerability than CVE-2012-5766.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130560-sql(83012)]
Cross-site scripting (XSS) vulnerability in the RPC adapter for the Web 2.0 and Mobile toolkit in IBM WebSphere Application Server (WAS) 8.5 before 8.5.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted response.
[http://www-01.ibm.com/support/docview.wss?&uid=swg21632423]
[PM83402]
[was-cve20130565-xss(83138)]
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Accelerator JSPs, (2) Organization Administration Console JSPs, and (3) Administration Console JSPs in WebSphere Commerce Tools in IBM WebSphere Commerce 5.6.1.0 through 5.6.1.5, 6.0.0.0 through 6.0.0.11, and 7.0.0.0 through 7.0.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21647750]
[JR46776]
[wscommerce-cve20130566-xss(83139)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0568, and CVE-2013-0475.
[IC91151]
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130567-infodisc(83164)]
IBM Sterling B2B Integrator 5.1 and 5.2 and Sterling File Gateway 2.1 and 2.2 allow remote authenticated users to obtain sensitive information about application implementation via unspecified vectors, a different vulnerability than CVE-2013-0463, CVE-2013-2985, CVE-2013-2987, CVE-2013-3020, CVE-2013-0475, and CVE-2013-0567.
[http://www-01.ibm.com/support/docview.wss?uid=swg21640830]
[sterling-b2b-cve20130568-infodisc(83165)]
Cross-site scripting (XSS) vulnerability in the Communities component in IBM Connections 4.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[LO74629]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635059]
[ibm-communities-cve20130569-xss(83354)]
The Fibre Channel over Ethernet (FCoE) feature in IBM System Networking and Blade Network Technology (BNT) switches running IBM Networking Operating System (aka NOS, formerly BLADE Operating System) floods data frames with unknown MAC addresses out on all interfaces on the same VLAN, which might allow remote attackers to obtain sensitive information in opportunistic circumstances by eavesdropping on the broadcast domain. IBM X-Force ID: 83166.
[ibm-networking-cve20130570(83166)]
[https://www-304.ibm.com/support/docview.wss?uid=isg3T1019715]
Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[http://www-01.ibm.com/support/docview.wss?uid=swg21635328]
[asf-cve20130571-xss(83246)]
Cross-site scripting (XSS) vulnerability in IBM Document Connect for Application Support Facility (aka DC4ASF) before 1.0.0.1218 in Application Support Facility (ASF) 3.4 for z/OS on Windows, Linux, and AIX allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21635328]
[asf-cve20130572-spoofing(83247)]
Cross-site scripting (XSS) vulnerability in the Tivoli Enterprise Portal browser client in IBM Tivoli Monitoring 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP02 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[IV32812]
[http://www-01.ibm.com/support/docview.wss?uid=swg21634920]
[ibm-tivoli-cve20130576-xss(83328)]
The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to bypass intended access restrictions and create, modify, or delete documents or scripts via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21651990]
[ibm-optim-cve20130577(83329)]
The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8.0 before HF128 and IBM Sterling Selling and Fulfillment Foundation 8.5 before HF93, 9.0 before HF73, 9.1.0 before FP45, and 9.2.0 before FP17, when the API tester is enabled, do not require administrative credentials, which allows remote authenticated users to obtain sensitive database information via a request to the API tester URI.
Per: http://www-01.ibm.com/support/docview.wss?uid=swg21636034
'AFFECTED PRODUCTS AND VERSIONS:
IBM Sterling Selling and Fulfillment Foundation 9.2.0
IBM Sterling Selling and Fulfillment Foundation 9.1.0
IBM Sterling Selling and Fulfillment Foundation 9.0
IBM Sterling Selling and Fulfillment Foundation 8.5
IBM Sterling Multi-Channel Fulfillment Solution 8.0'
[IC91829]
[http://www-01.ibm.com/support/docview.wss?uid=swg21636034]
[ibm-sterling-cve20130578-info-disclosure(83330)]
The Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote attackers to impersonate arbitrary users by leveraging access to a legitimate user's web browser either (1) before or (2) after authentication.
[http://www-01.ibm.com/support/docview.wss?uid=swg21651990]
[ibm-optim-cve20130579-session-fixation(83331)]
Cross-site request forgery (CSRF) vulnerability in the Optim E-Business Console in IBM Data Growth Solution for Oracle E-business Suite 6.0 through 9.1 allows remote authenticated users to hijack the authentication of arbitrary users.
[http://www-01.ibm.com/support/docview.wss?uid=swg21651990]
[ibm-optim-cve20130580-csrf(83332)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM Business Process Manager (BPM) 7.5.1.x, 8.0.0.x, and 8.0.1 before FP1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) ProcessPortal/jsp/socialPortal/dashboard.jsp, (2) teamworks/executeServiceByName, (3) portal/jsp/viewAdHocReportWizard.do, or (4) rest/bpm/wle/v1/process.
[JR45799]
[http://www-01.ibm.com/support/docview.wss?uid=swg21633593]
[bpm-cve20130581-xss(83333)]
Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.12, 6.2.1 before 6.2.1.5, and 6.2.2 before 6.2.2.4 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.12 and 6.2.1 before 6.2.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that triggers a SAML 2.0 response.
[IV26033]
[IV26034]
[IV31640]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635688]
The Data Replication Dashboard component in IBM InfoSphere Replication Server 9.7 and 10.x before 10.2.0.0-b113 allows remote attackers to obtain a list of all user accounts, along with information about whether each account requires a password, via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21634798]
[ibm-infosphere-cve20130584-info-disclosure(83355)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server through 8.5 FP3, 8.7 through FP2, and 9.1 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to the (1) web console and (2) repository management user interfaces.
[http://www-01.ibm.com/support/docview.wss?uid=swg21646136]
[infosphere-cve20130585-xss(83356)]
Cross-site scripting (XSS) vulnerability in the server in IBM Cognos Business Intelligence (BI) 8.4.1, 10.1, 10.1.1, 10.2, and 10.2.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21645566]
[cognosbi-cve20130586-xss(83380)]
Multiple cross-site scripting (XSS) vulnerabilities in IBM WebSphere Portal before 8.0.0.1 CF07 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) Portal, (2) Portal 7.0.0.2, (3) Portal 8.0, or (4) PortalWeb2 theme.
[PM90118]
[http://www-01.ibm.com/support/docview.wss?uid=swg21646618]
[wsportal-cve20130587-xss(84345)]
IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to bypass the remote image filtering mechanism and obtain sensitive information via a crafted e-mail message. IBM X-Force ID: 83371.
[ibm-inotes-cve20130589-info-disclosure(83371)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21671622]
Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0591.
[http://www-01.ibm.com/support/docview.wss?uid=swg21647740]
[inotes-cve20130590-xss(83814)]
Cross-site scripting (XSS) vulnerability in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3, a different vulnerability than CVE-2013-0590.
[http://www-01.ibm.com/support/docview.wss?uid=swg21647740]
[inotes-cve20130591-xss(83381)]
Cross-site scripting (XSS) vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 83815.
[ibm-inotes-cve20130592-xss(83815)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21671622]
Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001 allows remote attackers to execute arbitrary code via unknown vectors.
[http://www-01.ibm.com/support/docview.wss?uid=swg21635503]
[ibm-spss-cve20130593-code-exec(83382)]
Open redirect vulnerability in IBM iNotes before 8.5.3 Fix Pack 6 and 9.x before 9.0.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. IBM X-Force ID: 83383.
[ibm-inotes-cve20130594-open-redirect(83383)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21671622]
Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka SPR PTHN95XNR3.
[http://www-01.ibm.com/support/docview.wss?uid=swg21647740]
[inotes-cve20130595-xss(83431)]
[https://www-01.ibm.com/support/docview.wss?uid=swg21671622]
Cross-site scripting (XSS) vulnerability in the Administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://www.ibm.com/support/docview.wss?uid=swg21647522]
[PM73445]
[was-cve20130596-xss(83608)]
Cross-site scripting (XSS) vulnerability in IBM WebSphere Application Server (WAS) 7.0 before 7.0.0.29, 8.0 before 8.0.0.7, and 8.5 before 8.5.5.0, when OAuth is used, allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[PM85834]
[PM87131]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644047]
[was-cve20130597-xss(83609)]
Cross-site request forgery (CSRF) vulnerability in the Web Client in IBM Rational ClearQuest 7.1 before 7.1.2.12, 8.0 before 8.0.0.8, and 8.0.1 before 8.0.1.1 allows remote attackers to hijack the authentication of arbitrary users.
[PM88185]
[http://www-01.ibm.com/support/docview.wss?uid=swg21648665]
[clearquest-cve20130598-csrf(83611)]
IBM Eclipse Help System (IEHS), as used in IBM Rational Directory Server 5.1.1 through 5.1.1.2 and 5.2 through 5.2.1 and other products, allows remote attackers to obtain sensitive information by providing a crafted parameter path and then reading the debug information associated with the 500 HTTP status code.
[60107]
[http://www-01.ibm.com/support/docview.wss?uid=swg21637151]
[ibm-iehs-cve20130599-info-disclosure(83613)]
Unspecified vulnerability on IBM WebSphere DataPower XC10 Appliance devices 2.0 and 2.1 through 2.1 FP3 allows remote attackers to bypass authentication and perform administrative actions via unknown vectors.
[IC91726]
[http://www-01.ibm.com/support/docview.wss?uid=swg21636324]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16380]
Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16449]
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0604.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16200]
Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0603.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16008]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16266]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16196]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0608, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:15499]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16037]
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0613.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16120]
Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0626.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16331]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0614, and CVE-2013-0618.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16452]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16295]
Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0609.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16461]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0618.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16491]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0617, and CVE-2013-0621.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16290]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16305]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, and CVE-2013-0621.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16138]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0607, CVE-2013-0608, CVE-2013-0611, and CVE-2013-0614.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:15822]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0620, and CVE-2013-0623.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16413]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, and CVE-2013-0623.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16275]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, and CVE-2013-0617.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16226]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-0624.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16484]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, and CVE-2013-0620.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:15670]
Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2013-0622.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:15969]
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
[http://www.adobe.com/support/security/advisories/apsa13-01.html]
[http://www.adobe.com/support/security/bulletins/apsb13-03.html]
[57164]
Stack-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0610.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[RHSA-2013:0150]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16289]
Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows local users to gain privileges via unknown vectors.
[SUSE-SU-2013:0044]
[SUSE-SU-2013:0047]
[openSUSE-SU-2013:0138]
[openSUSE-SU-2013:0193]
[GLSA-201308-03]
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
[oval:org.mitre.oval:def:16154]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.
[http://www.adobe.com/support/security/advisories/apsa13-01.html]
[http://www.adobe.com/support/security/bulletins/apsb13-03.html]
[57165]
Buffer overflow in Adobe Flash Player before 10.3.183.50 and 11.x before 11.5.502.146 on Windows and Mac OS X, before 10.3.183.50 and 11.x before 11.2.202.261 on Linux, before 11.1.111.31 on Android 2.x and 3.x, and before 11.1.115.36 on Android 4.x; Adobe AIR before 3.5.0.1060; and Adobe AIR SDK before 3.5.0.1060 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2013:0033]
[openSUSE-SU-2013:0121]
[openSUSE-SU-2013:0128]
[openSUSE-SU-2013:0168]
[openSUSE-SU-2013:0364]
[RHSA-2013:0149]
[http://www.adobe.com/support/security/bulletins/apsb13-01.html]
Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
[http://www.adobe.com/support/security/advisories/apsa13-01.html]
[http://www.adobe.com/support/security/bulletins/apsb13-03.html]
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
[http://www.adobe.com/support/security/advisories/apsa13-01.html]
[http://www.adobe.com/support/security/bulletins/apsb13-03.html]
[30210]
Buffer overflow in Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
[openSUSE-SU-2013:0279]
[openSUSE-SU-2013:0284]
[SUSE-SU-2013:0288]
[RHSA-2013:0243]
[http://www.adobe.com/support/security/bulletins/apsb13-04.html]
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and before 11.1.115.37 on Android 4.x allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted SWF content, as exploited in the wild in February 2013.
[openSUSE-SU-2013:0279]
[openSUSE-SU-2013:0284]
[SUSE-SU-2013:0288]
[RHSA-2013:0243]
[http://www.adobe.com/support/security/bulletins/apsb13-04.html]
Adobe Shockwave Player before 12.0.0.112 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-06.html]
[TA13-043A]
Stack-based buffer overflow in Adobe Shockwave Player before 12.0.0.112 allows attackers to execute arbitrary code via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-06.html]
[TA13-043A]
Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to obtain sensitive information via unspecified vectors.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0647.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Integer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.
[http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html]
[http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html]
[openSUSE-SU-2013:0335]
[openSUSE-SU-2013:0342]
[SUSE-SU-2013:0349]
[RHSA-2013:0551]
[GLSA-201308-03]
[http://www.adobe.com/support/security/advisories/apsa13-02.html]
[http://www.adobe.com/support/security/bulletins/apsb13-07.html]
[VU#422807]
[oval:org.mitre.oval:def:16406]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.
[http://blog.fireeye.com/research/2013/02/in-turn-its-pdf-time.html]
[http://blogs.adobe.com/psirt/2013/02/adobe-reader-and-acrobat-vulnerability-report.html]
[http://blogs.mcafee.com/mcafee-labs/digging-into-the-sandbox-escape-technique-of-the-recent-pdf-exploit]
[openSUSE-SU-2013:0335]
[openSUSE-SU-2013:0342]
[SUSE-SU-2013:0349]
[RHSA-2013:0551]
[GLSA-201308-03]
[http://www.adobe.com/support/security/advisories/apsa13-02.html]
[http://www.adobe.com/support/security/bulletins/apsb13-07.html]
[VU#422807]
[oval:org.mitre.oval:def:16296]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
Per: http://www.adobe.com/support/security/bulletins/apsb13-08.html
'Flash Player 11.6.602.168 and earlier versions for Windows
Flash Player 11.6.602.167 and earlier versions for Macintosh
Flash Player 11.2.202.270 and earlier for Linux'
[openSUSE-SU-2013:0359]
[openSUSE-SU-2013:0360]
[SUSE-SU-2013:0373]
[RHSA-2013:0574]
[http://www.adobe.com/support/security/bulletins/apsb13-08.html]
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0649 and CVE-2013-1374.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Integer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2013:0458]
[openSUSE-SU-2013:0459]
[openSUSE-SU-2013:0464]
[HPSBMU02948]
[RHSA-2013:0643]
[http://www.adobe.com/support/security/bulletins/apsb13-09.html]
Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-0638.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers to execute arbitrary code via crafted SWF content, as exploited in the wild in February 2013.
Per: http://www.adobe.com/support/security/bulletins/apsb13-08.html
'Flash Player 11.6.602.168 and earlier versions for Windows
Flash Player 11.6.602.167 and earlier versions for Macintosh
Flash Player 11.2.202.270 and earlier for Linux'
[openSUSE-SU-2013:0359]
[openSUSE-SU-2013:0360]
[SUSE-SU-2013:0373]
[RHSA-2013:0574]
[http://www.adobe.com/support/security/bulletins/apsb13-08.html]
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0644 and CVE-2013-1374.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2013:0458]
[openSUSE-SU-2013:0459]
[openSUSE-SU-2013:0464]
[HPSBMU02948]
[RHSA-2013:0643]
[http://www.adobe.com/support/security/bulletins/apsb13-09.html]
The Portal installation process in GE Intelligent Platforms Proficy Real-Time Information Portal stores sensitive information under the web root with insufficient access control, which allows remote attackers to read configuration files, and discover data-source credentials, via a direct request.
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf]
GE Intelligent Platforms Proficy Real-Time Information Portal does not restrict access to methods of an unspecified Java class, which allows remote attackers to obtain a username listing via an RMI call.
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-01.pdf]
Directory traversal vulnerability in substitute.bcl in the WebView CimWeb subsystem in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to read arbitrary files via a crafted packet.
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf]
CimWebServer in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary commands or cause a denial of service (daemon crash) via a crafted packet.
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-022-02.pdf]
The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.
[http://www.schneider-electric.com/download/ww/en/details/29960967-SE-Software-Update-Utility-Vulnerability-Disclosure/?reference=SEVD-2013-009-01]
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf]
[http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130109_advisory_of_vulnerability_affecting_schneider_electric_s_software_upda.xml]
Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site.
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf]
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-014-01.pdf]
Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrary code by sending TCP port-12397 data that does not comply with a protocol.
[http://igss.schneider-electric.com/igss/igssupdates/v100/progupdatesv100.zip]
[http://igss.schneider-electric.com/igss/igssupdates/v90/progupdatesv90.zip]
[http://www.us-cert.gov/control_systems/pdf/ICSA-13-018-01.pdf]
[45218]
Heap-based buffer overflow in RFManagerService.exe in Schneider Electric Accutech Manager 2.00.1 and earlier allows remote attackers to execute arbitrary code via a crafted HTTP request.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-043-01.pdf]
The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-084-01.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-628113.pdf]
Multiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute arbitrary code via a large buffer-size value in a Modbus Application Header.
Per: http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01
"The following Schneider Electric products bundle the Schneider Electric Modbus Serial Driver (ModbusDrv.exe), which is started when attempting to connect to a Programmable Logic Controller (PLC) via the serial port of a personal computer:
TwidoSuite Versions 2.31.04 and earlier,
PowerSuite Versions 2.6 and earlier,
SoMove Versions 1.7 and earlier,
SoMachine Versions 2.0, 3.0, 3.1, and 3.0 XS,
Unity Pro Versions 7.0 and earlier,
UnityLoader Versions 2.3 and earlier,
Concept Versions 2.6 SR7 and earlier,
ModbusCommDTM sl Versions 2.1.2 and earlier,
PL7 Versions 4.5 SP5 and earlier,
SFT2841 Versions 14, 13.1 and earlier, and
OPC Factory Server Versions 3.50 and earlier.
Modbus Serial Driver versions that are affected:
Windows XP 32 bit V1.10 IE v37,
Windows Vista 32 bit V2.2 IE12,
Windows 7 32 bit V2.2 IE12, and
Windows 7 64 bit V3.2 IE12."
[http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202013-070-01]
[http://ics-cert.us-cert.gov/advisories/ICSA-14-086-01]
[66500]
[45219]
[45220]
Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf]
[http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/]
[http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper]
[44678]
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdf]
[http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/]
[http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paper]
Schweitzer Engineering Laboratories (SEL) AcSELerator QuickSet before 5.12.0.1 uses weak permissions for its Program Files directory, which allows local users to replace executable files, and consequently gain privileges, via standard filesystem operations.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-01.pdf]
The configuration utility in MatrikonOPC Security Gateway 1.0 allows remote attackers to cause a denial of service (unhandled exception and application crash) via a TCP RST packet.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01]
Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
The HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to cause a denial of service (daemon crash) via a crafted HTTP request.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
CRLF injection vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
Directory traversal vulnerability in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to read HMI web-application source code and user-defined scripts via a crafted URL.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
Cross-site scripting (XSS) vulnerability in the HMI web application in Siemens WinCC (TIA Portal) 11 allows remote authenticated users to inject arbitrary web script or HTML via unspecified data.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-03.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-212483.pdf]
Directory traversal vulnerability in the web interface in the Health Monitor service in MatrikonOPC A&E Historian 1.0.0.0 allows remote attackers to read and delete arbitrary files via a crafted URL.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-106-01]
Buffer overflow in the RegReader ActiveX control in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to execute arbitrary code via a long parameter.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
Buffer overflow in CCEServer (aka the central communications component) in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to cause a denial of service via a crafted packet.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly assign privileges for the database containing WebNavigator credentials, which allows remote authenticated users to obtain sensitive information via a SQL query.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
The web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote attackers to obtain sensitive information or cause a denial of service via a crafted project file.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, does not properly represent WebNavigator credentials in a database, which makes it easier for remote authenticated users to obtain sensitive information via a SQL query.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
Directory traversal vulnerability in the web server in Siemens WinCC before 7.2, as used in SIMATIC PCS7 before 8.0 SP1 and other products, allows remote authenticated users to read arbitrary files via vectors involving a query for a pathname.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-079-02.pdf]
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-714398.pdf]
Stack-based buffer overflow in the web server in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a long HTTP header.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf]
Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote attackers to cause a denial of service (NULL pointer dereference and application crash) via malformed data in a formatted text command.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf]
Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 do not properly handle exceptions, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via malformed data in a formatted text command, leading to out-of-bounds access to (1) heap or (2) stack memory.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf]
The DataSim and DataPid demonstration clients in Cogent Real-Time Systems Cogent DataHub before 7.3.0, OPC DataHub before 6.4.22, Cascade DataHub before 6.4.22 on Windows, and DataHub QuickTrend before 7.3.0 allow remote servers to cause a denial of service (incorrect pointer access and client crash) via malformed data in a formatted text command.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-095-01.pdf]
SQL injection vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01]
Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal does not restrict unspecified size and amount values, which allows remote attackers to execute arbitrary code or cause a denial of service (resource consumption) via unknown vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01]
Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01]
The installer routine in Schneider Electric MiCOM S1 Studio uses world-writable permissions for executable files, which allows local users to modify the service or the configuration files, and consequently gain privileges or trigger incorrect protective-relay operation, via a Trojan horse executable file.
[http://download.schneider-electric.com/files?p_File_Id=56543584&p_File_Name=SEVD-2013-087-01-MiCOM-S1-Studio-SW.pdf]
[http://ics-cert.us-cert.gov/pdf/ICSA-13-100-01.pdf]
Cross-site scripting (XSS) vulnerability in Invensys Wonderware Information Server (WIS) 4.0 SP1SP1, 4.5- Portal, and 5.0- Portal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-113-01]
The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01]
The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier performs network-beacon broadcasts, which allows remote attackers to obtain potentially sensitive information about device presence by listening for broadcast traffic.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01]
The Emerson Process Management ROC800 RTU with software 3.50 and earlier, DL8000 RTU with software 2.30 and earlier, and ROC800L RTU with software 1.20 and earlier have hardcoded credentials in a ROM, which makes it easier for remote attackers to obtain shell access to the underlying OS by leveraging knowledge of the ROM contents from a product installation elsewhere.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-259-01]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
The Galil RIO-47100 Pocket PLC allows remote attackers to cause a denial of service via a session that includes "repeated requests."
[http://ics-cert.us-cert.gov/advisories/ICSA-13-116-01]
[http://www.galilmc.com/support/downloads/firmware_rev/firm47xxx.html]
Siemens SIMATIC S7-1200 PLCs 2.x and 3.x allow remote attackers to cause a denial of service (defect-mode transition and control outage) via crafted packets to TCP port 102 (aka the ISO-TSAP port).
[http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-724606.pdf]
SQL injection vulnerability in Cybozu Garoon 2.5.0 through 3.5.3 allows remote authenticated users to execute arbitrary SQL commands by leveraging a logging privilege.
[http://cs.cybozu.co.jp/information/20130125up02.php]
[JVN#07629635]
[JVNDB-2013-000007]
Cross-site scripting (XSS) vulnerability in Cybozu Garoon 2.0.0 through 3.5.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://cs.cybozu.co.jp/information/20130125up01.php]
[JVN#95863326]
[JVNDB-2013-000008]
Cross-site scripting (XSS) vulnerability in imgboard.com imgboard before 1.22R6.1 u and 20xx before 2010u allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[JVN#09223079]
[JVNDB-2013-000009]
[http://www.big.or.jp/~talk/t-club/soft/mini_r6/index.cgi]
Directory traversal vulnerability in the GREE application before 1.3.3 for Android allows remote attackers to obtain sensitive information via a crafted URL, which is not properly handled during interaction with other applications.
[JVN#78601526]
[JVNDB-2013-000010]
Directory traversal vulnerability in LSI 3ware Disk Manager (3DM) before 2 allows remote attackers to read arbitrary files via unspecified vectors.
[http://jvn.jp/en/jp/JVN02596643/995349/index.html]
[JVN#02596643]
[JVNDB-2013-000011]
NEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier does not provide access control, which allows remote attackers to perform arbitrary RAID disk operations via unspecified vectors.
[http://jpn.nec.com/security-info/secinfo/nv13-004.html]
[JVN#75585394]
[JVNDB-2013-000012]
Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007, Ichitaro Government 2006 and 2007, Ichitaro Portable with oreplug, Hanako 2006 through 2013, Hanako Police, Hanako Police 3, and Hanako Police 2010 allows remote attackers to execute arbitrary code via a crafted file.
[JVN#16817324]
[JVNDB-2013-000015]
[http://www.justsystems.com/jp/info/js13001.html]
Cross-site scripting (XSS) vulnerability in dopvCOMET* 0009b allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.
[JVN#64756004]
[JVNDB-2013-000013]
[http://tech.bayashi.net/dc/]
Cross-site scripting (XSS) vulnerability in dopvSTAR* 0091 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header, which is not properly handled during display of the access log.
[JVN#36339873]
[JVNDB-2013-000014]
[http://tech.bayashi.net/ds/]
Buffer overflow in Kingsoft Writer 2007 and 2010 before 2724 allows remote attackers to execute arbitrary code via a crafted RTF document.
[http://jvn.jp/en/jp/JVN55924624/22479/index.html]
[JVN#55924624]
[JVNDB-2013-000016]
[http://www.kingsoft.jp/support/office/support_news/writer2010_2723]
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to cause a denial of service (daemon outage) via a crafted authentication request.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01]
[http://jvn.jp/en/jp/JVN45545972/995359/index.html]
[JVN#45545972]
[JVNDB-2013-000018]
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted packet.
[http://jvn.jp/en/jp/JVN01611135/995359/index.html]
[JVN#01611135]
[JVNDB-2013-000019]
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote authenticated users to cause a denial of service (daemon outage) via a crafted pty request.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01]
[http://jvn.jp/en/jp/JVN52492830/995359/index.html]
[JVN#52492830]
[JVNDB-2013-000020]
IPSSH (aka the SSH server) in Wind River VxWorks 6.5 through 6.9 allows remote attackers to execute arbitrary code or cause a denial of service (daemon hang) via a crafted public-key authentication request.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01]
[http://jvn.jp/en/jp/JVN20671901/995359/index.html]
[JVN#20671901]
[JVNDB-2013-000021]
The WebCLI component in Wind River VxWorks 5.5 through 6.9 allows remote authenticated users to cause a denial of service (CLI session crash) via a crafted command string.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01]
[http://jvn.jp/en/jp/JVN65923092/995359/index.html]
[JVN#65923092]
[JVNDB-2013-000022]
The web server in Wind River VxWorks 5.5 through 6.9 allows remote attackers to cause a denial of service (daemon crash) via a crafted URI.
[http://ics-cert.us-cert.gov/advisories/ICSA-13-091-01]
[http://jvn.jp/en/jp/JVN41022517/995359/index.html]
[JVN#41022517]
[JVNDB-2013-000023]
Multiple cross-site request forgery (CSRF) vulnerabilities in the web-based management utility on the NEC AtermWR9500N, AtermWR8600N, AtermWR8370N, AtermWR8160N, AtermWM3600R, and AtermWM3450RN routers allow remote attackers to hijack the authentication of administrators for requests that (1) initialize settings or (2) reboot the device.
[http://jpn.nec.com/security-info/secinfo/nv13-005.html]
[http://jvn.jp/en/jp/JVN59503133/6443/index.html]
[JVN#59503133]
[JVNDB-2013-000024]
The Simeji application 4.8.1 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
[JVN#77360971]
[JVNDB-2013-000029]
The ArtIME Japanese Input application 1.1.2 and earlier for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
[JVN#80922020]
[JVNDB-2013-000026]
The COBIME application before 0.9.4 for Android uses weak permissions for unspecified files, which allows attackers to obtain sensitive information via an application that accesses the local filesystem.
[JVN#11249169]
[JVNDB-2013-000027]
wp-php-widget.php in the WP PHP widget plugin 1.0.2 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message.
[wpphpwidget-wpphpwidget-path-disclosure(80906)]
Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges via a Trojan horse hosts list containing a long line.
[23945]
[http://www.securation.com/files/2013/01/ec.patch]
[57175]
[https://bugs.gentoo.org/show_bug.cgi?id=451198]
[https://bugzilla.redhat.com/show_bug.cgi?id=894092]
Multiple heap-based buffer overflows in etxrw.dll in Kingsoft Spreadsheets 2012 8.1.0.3030 allow remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a crafted spreadsheet file.
[1028713]
PHP remote file inclusion vulnerability in includes/generate-pdf.php in the WP ecommerce Shop Styling plugin for WordPress before 1.8 allows remote attackers to execute arbitrary PHP code via a URL in the dompdf parameter.
[http://wordpress.org/plugins/wp-ecommerce-shop-styling/changelog/]
[57768]
[wp-shopstyling-generatepdf-file-include(81931)]
Stack-based buffer overflow in the ERM_convert_to_correct_webpath function in ermapper_u.dll in ERDAS ER Viewer before 13.00.0001 allows remote attackers to execute arbitrary code via a crafted pathname in an ERS file.
Multiple untrusted search path vulnerabilities in Global Mapper 14.1.0 allow local users to gain privileges via a Trojan horse (1) dwmapi.dll or (2) ibfs32.dll file in the current working directory, as demonstrated by a directory that contains a .gmc, .gmg, .gmp, .gms, .gmw, or .opt file.
Per: http://cwe.mitre.org/data/definitions/426.html 'CWE-426: Untrusted Search Path'
Multiple stack-based buffer overflows in NCSAddOn.dll in the ERDAS APOLLO ECWP plugin before 13.00.0001 for Internet Explorer, Firefox, and Chrome allow remote attackers to execute arbitrary code via a long property value.
Heap-based buffer overflow in Tracker Software PDF-XChange before 2.5.208 allows remote attackers to execute arbitrary code via a crafted Define Huffman Table header in a JPEG image file stream in a PDF file.
[57491]
[http://www.tracker-software.com/company/news_press_events/view/123]
[pdfxchange-viewer-bo(81427)]
Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.
[http://forum.sourcefabric.org/discussion/15052/security-patch-released-for-newscoop-4-1]
[https://github.com/sourcefabric/Newscoop/commit/4f948ba3afaaeb616006cbabc85906ef3254169d]
ajax.functions.php in the MailUp plugin before 1.3.3 for WordPress does not properly restrict access to unspecified Ajax functions, which allows remote attackers to modify plugin settings and conduct cross-site scripting (XSS) attacks by setting the wordpress_logged_in cookie. NOTE: this is due to an incomplete fix for a similar issue that was fixed in 1.3.2.
[http://plugins.trac.wordpress.org/changeset?new=682420]
[http://wordpress.org/extend/plugins/wp-mailup/changelog/]
[58467]
[mailup-ajaxfunctions-security-bypass(82847)]
Heap-based buffer overflow in PDFCore8.dll in Nuance PDF Reader before 8.1 allows remote attackers to execute arbitrary code via crafted font table directory values in a TTF file, related to naming table entries.
[60315]
Untrusted search path vulnerability in Corel PaintShop Pro X5 and X6 16.0.0.113, 15.2.0.2, and earlier allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jpg file.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[62836]
[corel-paintshop-cve20130733-code-exec(87763)]
Multiple cross-site scripting (XSS) vulnerabilities in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) search_words parameter in a search action to wpf.class.php or (2) togroupusers parameter in an add_user_togroup action to fs-admin/fs-admin.php.
[58059]
[wp-mingleforum-index-admin-xss(82187)]
Multiple SQL injection vulnerabilities in wpf.class.php in the Mingle Forum plugin before 1.0.34 for WordPress allow remote attackers to execute arbitrary SQL commands via the id parameter in a viewtopic (1) remove_post, (2) sticky, or (3) closed action or (4) thread parameter in a postreply action to index.php.
[58059]
[wp-mingleforum-index-sql-injection(82188)]
Multiple cross-site request forgery (CSRF) vulnerabilities in the Mingle Forum plugin 1.0.34 and possibly earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) modify user privileges or (2) conduct cross-site scripting (XSS) attacks via unspecified vectors.
[62133]
Open redirect vulnerability in Dell OpenManage Server Administrator (OMSA) before 7.3.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the file parameter to HelpViewer.
[61383]
Cross-site scripting (XSS) vulnerability in imagegen.ashx in Percipient Studios ImageGen before 2.9.0 for Umbraco CMS allows remote attackers to inject arbitrary web script or HTML via the font parameter.
[http://our.umbraco.org/projects/website-utilities/imagegen]
Stack-based buffer overflow in Corel PDF Fusion 1.11 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long ZIP directory entry name in an XPS file.
[26805]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA at the suggestion of the CVE project team. The candidate had been associated with a correct report of a security problem, but not a problem that is categorized as a vulnerability within CVE. Compromised or unauthorized SSL certificates are not within CVE's scope. Notes: none.
Use-after-free vulnerability in the TableBackgroundPainter::TableBackgroundData::Destroy function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an HTML document with a table containing many columns and column groups.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-05.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814713]
[oval:org.mitre.oval:def:17007]
The AutoWrapperChanger class in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly interact with garbage collection, which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-08.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=794158]
[oval:org.mitre.oval:def:17061]
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 do not properly implement quickstubs that use the jsval data type for their return values, which allows remote attackers to execute arbitrary code or cause a denial of service (compartment mismatch and application crash) via crafted JavaScript code that is not properly handled during garbage collection.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-09.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=816842]
[oval:org.mitre.oval:def:16570]
The gPluginHandler.handleEvent function in the plugin handler in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not properly enforce the Same Origin Policy, which allows remote attackers to conduct clickjacking attacks via crafted JavaScript code that listens for a mutation event.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-10.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=733305]
[oval:org.mitre.oval:def:16866]
The XBL.__proto__.toString implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 makes it easier for remote attackers to bypass the ASLR protection mechanism by calling the toString function of an XBL object.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-11.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=806031]
[oval:org.mitre.oval:def:17109]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-01.html]
[http://www.palemoon.org/releasenotes-ng.shtml]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=785358]
[https://bugzilla.mozilla.org/show_bug.cgi?id=794426]
[https://bugzilla.mozilla.org/show_bug.cgi?id=805745]
[https://bugzilla.mozilla.org/show_bug.cgi?id=805814]
[https://bugzilla.mozilla.org/show_bug.cgi?id=808481]
[https://bugzilla.mozilla.org/show_bug.cgi?id=812847]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814407]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814839]
[https://bugzilla.mozilla.org/show_bug.cgi?id=816994]
[oval:org.mitre.oval:def:16953]
Integer overflow in the JavaScript implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted string concatenation, leading to improper memory allocation and a heap-based buffer overflow.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-12.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=805121]
[oval:org.mitre.oval:def:16957]
Mozilla Firefox before 18.0 on Android and SeaMonkey before 2.15 do not restrict a touch event to a single IFRAME element, which allows remote attackers to obtain sensitive information or possibly conduct cross-site scripting (XSS) attacks via a crafted HTML document.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-06.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=790454]
[oval:org.mitre.oval:def:16616]
Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XBL file with multiple bindings that have SVG content.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-13.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=805024]
[oval:org.mitre.oval:def:16694]
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-16.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814001]
[oval:org.mitre.oval:def:17053]
Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-17.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814026]
[oval:org.mitre.oval:def:16812]
Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-18.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814027]
[oval:org.mitre.oval:def:16952]
Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-19.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814029]
[oval:org.mitre.oval:def:17101]
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-14.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=813901]
[oval:org.mitre.oval:def:16939]
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to execute arbitrary JavaScript code with chrome privileges by leveraging improper interaction between plugin objects and SVG elements.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-15.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=813906]
[oval:org.mitre.oval:def:17087]
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to spoof the address bar via vectors involving authentication information in the userinfo field of a URL, in conjunction with a 204 (aka No Content) HTTP status code.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-04.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=802026]
[oval:org.mitre.oval:def:16827]
Buffer overflow in the CharDistributionAnalysis::HandleOneChar function in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=780979]
[oval:org.mitre.oval:def:17086]
Use-after-free vulnerability in the mozilla::TrackUnionStream::EndTrack implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=787831]
[oval:org.mitre.oval:def:16832]
Use-after-free vulnerability in the imgRequest::OnStopFrame function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[57193]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=788959]
[oval:org.mitre.oval:def:16288]
Use-after-free vulnerability in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors related to Mesa drivers and a resized WebGL canvas.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=791905]
[oval:org.mitre.oval:def:17107]
The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions, which allows remote attackers to execute arbitrary code via crafted data, as demonstrated by e-mail message data.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-07.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=804237]
[oval:org.mitre.oval:def:16715]
Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 do not prevent multiple wrapping of WebIDL objects, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-23.html]
[USN-1729-1]
[USN-1729-2]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830614]
[oval:org.mitre.oval:def:17097]
Use-after-free vulnerability in the ~nsHTMLEditRules implementation in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[57194]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=803853]
[oval:org.mitre.oval:def:16189]
The nsSVGPathElement::GetPathLengthScale function in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[57195]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=812161]
[oval:org.mitre.oval:def:16171]
Stack-based buffer overflow in the Canvas implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via an HTML document that specifies invalid width and height values.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-03.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=815795]
[oval:org.mitre.oval:def:16990]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.1, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[RHSA-2013:0144]
[RHSA-2013:0145]
[http://www.mozilla.org/security/announce/2013/mfsa2013-01.html]
[http://www.palemoon.org/releasenotes-ng.shtml]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=768243]
[https://bugzilla.mozilla.org/show_bug.cgi?id=801195]
[https://bugzilla.mozilla.org/show_bug.cgi?id=806483]
[https://bugzilla.mozilla.org/show_bug.cgi?id=809064]
[https://bugzilla.mozilla.org/show_bug.cgi?id=811382]
[oval:org.mitre.oval:def:16199]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 18.0, Thunderbird before 17.0.2, and SeaMonkey before 2.15 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-01.html]
[http://www.palemoon.org/releasenotes-ng.shtml]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=756581]
[https://bugzilla.mozilla.org/show_bug.cgi?id=768750]
[https://bugzilla.mozilla.org/show_bug.cgi?id=787818]
[https://bugzilla.mozilla.org/show_bug.cgi?id=795284]
[oval:org.mitre.oval:def:16813]
Heap-based buffer overflow in the gfxTextRun::ShrinkToLigatureBoundaries function in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.1, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.1, and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted document.
[SUSE-SU-2013:0048]
[SUSE-SU-2013:0049]
[openSUSE-SU-2013:0131]
[openSUSE-SU-2013:0149]
[http://www.mozilla.org/security/announce/2013/mfsa2013-02.html]
[USN-1681-1]
[USN-1681-2]
[USN-1681-4]
[https://bugzilla.mozilla.org/show_bug.cgi?id=785555]
[oval:org.mitre.oval:def:17019]
The RasterImage::DrawFrameTo function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read and application crash) via a crafted GIF image.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:1812]
[http://www.mozilla.org/security/announce/2013/mfsa2013-22.html]
[USN-1729-1]
[USN-1729-2]
[https://bugzilla.mozilla.org/show_bug.cgi?id=801366]
[oval:org.mitre.oval:def:17159]
The Chrome Object Wrapper (COW) and System Only Wrapper (SOW) implementations in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent modifications to a prototype, which allows remote attackers to obtain sensitive information from chrome objects or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-24.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=809652]
[oval:org.mitre.oval:def:16861]
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 do not prevent JavaScript workers from reading the browser-profile directory name, which has unspecified impact and remote attack vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-25.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827193]
[oval:org.mitre.oval:def:16797]
Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:0271]
[RHSA-2013:0272]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-26.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=831095]
[oval:org.mitre.oval:def:16950]
Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow man-in-the-middle attackers to spoof the address bar by operating a proxy server that provides a 407 HTTP status code accompanied by web script, as demonstrated by a phishing attack on an HTTPS site.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:0271]
[RHSA-2013:0272]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-27.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=796475]
[oval:org.mitre.oval:def:16666]
Use-after-free vulnerability in the nsDisplayBoxShadowOuter::Paint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=798691]
[oval:org.mitre.oval:def:16977]
The ClusterIterator::NextCluster function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=798867]
[oval:org.mitre.oval:def:16619]
The nsCodingStateMachine::NextState function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=801330]
[oval:org.mitre.oval:def:16747]
Use-after-free vulnerability in the nsOverflowContinuationTracker::Finish function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted document that uses Cascading Style Sheets (CSS) -moz-column-* properties.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:0271]
[RHSA-2013:0272]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=812893]
[oval:org.mitre.oval:def:16383]
Use-after-free vulnerability in the nsPrintEngine::CommonPrint function in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=821991]
[oval:org.mitre.oval:def:16934]
Heap-based buffer overflow in the nsSaveAsCharset::DoCharsetConversion function in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via unspecified vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:0271]
[RHSA-2013:0272]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-28.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827070]
[oval:org.mitre.oval:def:16906]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Firefox ESR 17.x before 17.0.3, Thunderbird before 17.0.3, Thunderbird ESR 17.x before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[RHSA-2013:0271]
[RHSA-2013:0272]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-21.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=690970]
[https://bugzilla.mozilla.org/show_bug.cgi?id=761448]
[https://bugzilla.mozilla.org/show_bug.cgi?id=780549]
[https://bugzilla.mozilla.org/show_bug.cgi?id=812380]
[https://bugzilla.mozilla.org/show_bug.cgi?id=818241]
[https://bugzilla.mozilla.org/show_bug.cgi?id=822858]
[https://bugzilla.mozilla.org/show_bug.cgi?id=826471]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830399]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830975]
[https://bugzilla.mozilla.org/show_bug.cgi?id=832162]
[oval:org.mitre.oval:def:16219]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 19.0, Thunderbird before 17.0.3, and SeaMonkey before 2.16 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:0323]
[openSUSE-SU-2013:0324]
[http://www.mozilla.org/security/announce/2013/mfsa2013-21.html]
[USN-1729-1]
[USN-1729-2]
[USN-1748-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=766452]
[https://bugzilla.mozilla.org/show_bug.cgi?id=790373]
[https://bugzilla.mozilla.org/show_bug.cgi?id=797977]
[https://bugzilla.mozilla.org/show_bug.cgi?id=799803]
[https://bugzilla.mozilla.org/show_bug.cgi?id=799907]
[https://bugzilla.mozilla.org/show_bug.cgi?id=801114]
[https://bugzilla.mozilla.org/show_bug.cgi?id=805294]
[https://bugzilla.mozilla.org/show_bug.cgi?id=809295]
[https://bugzilla.mozilla.org/show_bug.cgi?id=810169]
[https://bugzilla.mozilla.org/show_bug.cgi?id=819635]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827687]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830943]
[oval:org.mitre.oval:def:17119]
Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2 allows remote attackers to inject arbitrary web script or HTML via the id parameter in conjunction with an invalid value of the format parameter.
[http://www.bugzilla.org/security/3.6.12/]
[MDVSA-2013:066]
[https://bugzilla.mozilla.org/show_bug.cgi?id=842038]
The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product queries depending on whether a product exists, which allows remote attackers to discover private product names by using debug mode for a query.
[http://www.bugzilla.org/security/3.6.12/]
[MDVSA-2013:066]
[https://bugzilla.mozilla.org/show_bug.cgi?id=824399]
Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2, Firefox ESR 17.x before 17.0.4, Thunderbird before 17.0.4, Thunderbird ESR 17.x before 17.0.4, and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[openSUSE-SU-2013:0431]
[openSUSE-SU-2013:0465]
[openSUSE-SU-2013:0467]
[openSUSE-SU-2013:0468]
[SUSE-SU-2013:0470]
[RHSA-2013:0614]
[RHSA-2013:0627]
[http://twitter.com/thezdi/statuses/309484730506698752]
[http://twitter.com/VUPEN/statuses/309505403631325184]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-29.html]
[58391]
[USN-1758-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=848644]
[oval:org.mitre.oval:def:16737]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[RHSA-2013:0696]
[RHSA-2013:0697]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-30.html]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=635852]
[https://bugzilla.mozilla.org/show_bug.cgi?id=771942]
[https://bugzilla.mozilla.org/show_bug.cgi?id=784730]
[https://bugzilla.mozilla.org/show_bug.cgi?id=813442]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827870]
[https://bugzilla.mozilla.org/show_bug.cgi?id=834240]
[https://bugzilla.mozilla.org/show_bug.cgi?id=839621]
[https://bugzilla.mozilla.org/show_bug.cgi?id=840263]
[https://bugzilla.mozilla.org/show_bug.cgi?id=840353]
[https://bugzilla.mozilla.org/show_bug.cgi?id=852923]
[oval:org.mitre.oval:def:16629]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 20.0 and SeaMonkey before 2.17 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the nsContentUtils::HoldJSObjects function and the nsAutoPtr class, and other vectors.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[openSUSE-SU-2013:0875]
[http://www.mozilla.org/security/announce/2013/mfsa2013-30.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=808736]
[https://bugzilla.mozilla.org/show_bug.cgi?id=815315]
[https://bugzilla.mozilla.org/show_bug.cgi?id=817841]
[https://bugzilla.mozilla.org/show_bug.cgi?id=824643]
[https://bugzilla.mozilla.org/show_bug.cgi?id=824856]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827596]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830595]
[https://bugzilla.mozilla.org/show_bug.cgi?id=831055]
[https://bugzilla.mozilla.org/show_bug.cgi?id=835499]
[https://bugzilla.mozilla.org/show_bug.cgi?id=837714]
[https://bugzilla.mozilla.org/show_bug.cgi?id=839209]
[https://bugzilla.mozilla.org/show_bug.cgi?id=842300]
[https://bugzilla.mozilla.org/show_bug.cgi?id=849014]
[oval:org.mitre.oval:def:17079]
Unspecified vulnerability in the browser engine in Mozilla Firefox before 20.0 on Android allows remote attackers to cause a denial of service (stack memory corruption and application crash) or possibly execute arbitrary code via unknown vectors involving a plug-in.
[SUSE-SU-2013:0645]
[http://www.mozilla.org/security/announce/2013/mfsa2013-30.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=842687]
The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[RHSA-2013:1135]
[RHSA-2013:1144]
[http://www.mozilla.org/security/announce/2013/mfsa2013-40.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[58826]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=629816]
[oval:org.mitre.oval:def:17150]
Mozilla Firefox before 20.0 and SeaMonkey before 2.17, when gfx.color_management.enablev4 is used, do not properly handle color profiles during PNG rendering, which allows remote attackers to obtain sensitive information from process memory or cause a denial of service (memory corruption) via a grayscale PNG image.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[http://www.mozilla.org/security/announce/2013/mfsa2013-39.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=722831]
[oval:org.mitre.oval:def:17021]
Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 do not ensure the correctness of the address bar during history navigation, which allows remote attackers to conduct cross-site scripting (XSS) attacks or phishing attacks by leveraging control over navigation timing.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[RHSA-2013:0696]
[RHSA-2013:0697]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-38.html]
[58837]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=803870]
[oval:org.mitre.oval:def:16928]
Mozilla Firefox before 20.0 and SeaMonkey before 2.17 do not prevent origin spoofing of tab-modal dialogs, which allows remote attackers to conduct phishing attacks via a crafted web site.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[http://www.mozilla.org/security/announce/2013/mfsa2013-37.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=626775]
[oval:org.mitre.oval:def:17065]
The System Only Wrapper (SOW) implementation in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 does not prevent use of the cloneNode method for cloning a protected node, which allows remote attackers to bypass the Same Origin Policy or possibly execute arbitrary JavaScript code with chrome privileges via a crafted web site.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[RHSA-2013:0696]
[RHSA-2013:0697]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-36.html]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=825697]
[oval:org.mitre.oval:def:16842]
The WebGL subsystem in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 on Linux does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (free of unallocated memory) via unspecified vectors.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[RHSA-2013:0696]
[RHSA-2013:0697]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-35.html]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=827106]
[https://bugzilla.mozilla.org/show_bug.cgi?id=838413]
Untrusted search path vulnerability in the Mozilla Updater in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, and SeaMonkey before 2.17 allows local users to gain privileges via a Trojan horse DLL file in an unspecified directory.
Per: http://cwe.mitre.org/data/definitions/426.html
'CWE-426: Untrusted Search Path'
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[http://www.mozilla.org/security/announce/2013/mfsa2013-34.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830134]
[oval:org.mitre.oval:def:17146]
Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which app_tmp is used.
[SUSE-SU-2013:0645]
[http://www.mozilla.org/security/announce/2013/mfsa2013-33.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=844832]
Buffer overflow in the Mozilla Maintenance Service in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, and Thunderbird ESR 17.x before 17.0.5 on Windows allows local users to gain privileges via crafted arguments.
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[http://www.mozilla.org/security/announce/2013/mfsa2013-32.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=848417]
[oval:org.mitre.oval:def:17155]
Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman, as distributed with Cairo and used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size, leading to an out-of-bounds write operation.
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[SUSE-SU-2013:0645]
[SUSE-SU-2013:0850]
[openSUSE-SU-2013:0875]
[RHSA-2013:0696]
[RHSA-2013:0697]
[DSA-2699]
[http://www.mozilla.org/security/announce/2013/mfsa2013-31.html]
[USN-1791-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=825721]
[oval:org.mitre.oval:def:16909]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-41.html]
[59855]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=787283]
[https://bugzilla.mozilla.org/show_bug.cgi?id=808402]
[https://bugzilla.mozilla.org/show_bug.cgi?id=849597]
[https://bugzilla.mozilla.org/show_bug.cgi?id=852315]
[https://bugzilla.mozilla.org/show_bug.cgi?id=864558]
[https://bugzilla.mozilla.org/show_bug.cgi?id=866544]
[oval:org.mitre.oval:def:17062]
The client in Novell GroupWise 8.0 before 8.0.3 HP2 and 2012 before SP1 HP1 allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference) via unspecified vectors.
[http://www.novell.com/support/kb/doc.php?id=7011687]
[https://bugzilla.novell.com/show_bug.cgi?id=792535]
[https://www.htbridge.com/advisory/HTB23131]
Multiple cross-site scripting (XSS) vulnerabilities in the search feature in iTop (aka IT Operations Portal) 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to pages/UI.php or (2) expression parameter to pages/run_query.php. NOTE: some of these details are obtained from third party information.
[20130123 CVE-2013-0805]
[http://packetstormsecurity.com/files/119767/iTop-Cross-Site-Scripting.html]
[20130123 CVE-2013-0805 / CSNC-2013-001]
[itop-ui-runquery-xss(81498)]
[https://www.csnc.ch/misc/files/advisories/CVE-2013-0805.txt]
Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.
[20130123 Cross-Site Scripting (XSS) vulnerability in gpEasy]
[http://packetstormsecurity.com/files/119805/gpEasy-3.5.2-Cross-Site-Scripting.html]
[gpeasy-index-section-xss(81472)]
[https://github.com/oyejorge/gpEasy-CMS/commit/40f1b4a5749a621cd27c5ca39900dbcf8701969d]
[https://www.htbridge.com/advisory/HTB23137]
Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors, a different vulnerability than CVE-2013-1493.
[openSUSE-SU-2013:0430]
[SUSE-SU-2013:0434]
[openSUSE-SU-2013:0438]
[SUSE-SU-2013:0701]
[[distro-pkg-dev] 20130304 [SECURITY] IcedTea6 1.11.9 and 1.12.4 Released!]
[HPSBUX02857]
[SSRT101156]
[RHSA-2013:0601]
[RHSA-2013:0603]
[RHSA-2013:0604]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#688246]
[MDVSA-2013:095]
[http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/1915099.xml]
[http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html]
[58296]
[USN-1755-2]
[TA13-064A]
[oval:org.mitre.oval:def:19076]
[oval:org.mitre.oval:def:19320]
[oval:org.mitre.oval:def:19479]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088]
Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
[TA13-253A]
[MS13-071]
[oval:org.mitre.oval:def:18579]
Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1307.
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:15979]
The PDF functionality in Google Chrome before 24.0.1312.52 does not properly perform a cast of an unspecified variable during processing of the root of the structure tree, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[https://code.google.com/p/chromium/issues/detail?id=162153]
[oval:org.mitre.oval:def:16272]
Google Chrome before 24.0.1312.52 does not properly maintain database metadata, which allows remote attackers to bypass intended file-access restrictions via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[https://code.google.com/p/chromium/issues/detail?id=162114]
[oval:org.mitre.oval:def:16322]
The IPC layer in Google Chrome before 24.0.1312.52 on Windows omits a NUL character required for termination of an unspecified data structure, which has unknown impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=162066]
[oval:org.mitre.oval:def:15907]
Directory traversal vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to have an unspecified impact by leveraging access to an extension process.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=161836]
[oval:org.mitre.oval:def:15917]
Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to printing.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=160380]
[oval:org.mitre.oval:def:16310]
Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to printing.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=154485]
[oval:org.mitre.oval:def:15726]
Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (out-of-bounds read) via vectors involving glyphs.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=154283]
[oval:org.mitre.oval:def:16307]
Unspecified vulnerability in the Geolocation implementation in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service (application crash) via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=152921]
[oval:org.mitre.oval:def:16263]
Google V8 before 3.14.5.3, as used in Google Chrome before 24.0.1312.52, does not properly implement garbage collection, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=150545]
[oval:org.mitre.oval:def:16459]
Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of extension tabs.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=145363]
[oval:org.mitre.oval:def:15868]
Google Chrome before 24.0.1312.52 on Linux uses weak permissions for shared memory segments, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update.html]
[openSUSE-SU-2013:0236]
[https://code.google.com/p/chromium/issues/detail?id=143859]
Use-after-free vulnerability in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of fonts in CANVAS elements.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html]
[https://code.google.com/p/chromium/issues/detail?id=151008]
[oval:org.mitre.oval:def:16327]
Google Chrome before 24.0.1312.56 does not validate URLs during the opening of new windows, which has unspecified impact and remote attack vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html]
[https://code.google.com/p/chromium/issues/detail?id=170532]
[oval:org.mitre.oval:def:16335]
Array index error in the content-blocking functionality in Google Chrome before 24.0.1312.56 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html]
[https://code.google.com/p/chromium/issues/detail?id=169770]
[oval:org.mitre.oval:def:16000]
Google Chrome before 24.0.1312.56 does not properly handle %00 characters in pathnames, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html]
[https://code.google.com/p/chromium/issues/detail?id=166867]
[oval:org.mitre.oval:def:16456]
content/renderer/media/webrtc_audio_renderer.cc in Google Chrome before 24.0.1312.56 on Mac OS X does not use an appropriate buffer size for the 96 kHz sampling rate, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a web site that provides WebRTC audio.
[http://googlechromereleases.blogspot.com/2013/01/stable-channel-update_22.html]
[http://src.chromium.org/viewvc/chrome/trunk/src/content/renderer/media/webrtc_audio_renderer.cc?r1=175323&r2=175322&pathrev=175323]
[http://src.chromium.org/viewvc/chrome?view=rev&revision=175323]
[https://code.google.com/p/chromium/issues/detail?id=166523]
[https://codereview.chromium.org/11773017]
Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=85a14dbd5dca34320f58b1ba11dd6dd0df4fb3be]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f18c873ab5ee3c78d00fdcc2582b39c133faecb4]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
libavcodec/alsdec.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via a crafted block length, which triggers an out-of-bounds write.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=0ceca269b66ec12a23bf0907bd2c220513cdbf16]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6df0d3e2916c223dbe4262bf1b876dff1cb3f980]
[DSA-2855]
[http://www.ffmpeg.org/security.html]
Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=a7ee6281f7ef1c29284e3a4cadfe0f227ffde1ed]
[DSA-2855]
[http://www.ffmpeg.org/security.html]
The ff_id3v2_parse function in libavformat/id3v2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via ID3v2 header data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=10416a4d56fa8a89784e4fb62099c3cab17a9952]
[http://www.ffmpeg.org/security.html]
The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6abb9a901fca27da14d4fffbb01948288b5da3ba]
[http://www.ffmpeg.org/security.html]
[MDVSA-2014:227]
The roq_decode_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted (1) width or (2) height dimension that is not a multiple of sixteen in id RoQ video data.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3ae610451170cd5a28b33950006ff0bd23036845]
[DSA-2855]
[http://www.ffmpeg.org/security.html]
The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted H.264 data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=d6c184880ee2e09fd68c0ae217173832cee5afc1]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
The decode_frame function in libavcodec/eamad.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Electronic Arts Madcow video data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=63ac64864c6e0e84355aa3caa5b92208997a9a8d]
[http://www.ffmpeg.org/security.html]
The parse_picture_segment function in libavcodec/pgssubdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted RLE data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c0d68be555f5858703383040e04fcd6529777061]
[http://www.ffmpeg.org/security.html]
[MDVSA-2014:227]
The wavpack_decode_frame function in libavcodec/wavpack.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted WavPack data, which triggers an out-of-bounds array access, possibly due to an off-by-one error.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=be818df547c3b0ae4fadb50fd210139a8636706a]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
The mjpeg_decode_scan_progressive_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted MJPEG data.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1f41cffe1e3e79620f587545bdfcbd7e6e68ed29]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
Integer overflow in the alac_decode_close function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a large number of samples per frame in Apple Lossless Audio Codec (ALAC) data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3920d1387834e2bc334aff9f518f4beb24e470bd]
[http://www.ffmpeg.org/security.html]
The lpc_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Apple Lossless Audio Codec (ALAC) data, related to a large nb_samples value.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=fd4f4923cce6a2cbf4f48640b4ac706e614a1594]
[http://www.ffmpeg.org/security.html]
The decode_frame_ilbm function in libavcodec/iff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted height value in IFF PBM/ILBM bitmap data.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=2fbb37b51bbea891392ad357baf8f3dff00bac05]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=13451f5520ce6b0afde861b2285dda659f8d4fb4]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=2502914c5f8eb77659d7c0868396862557a63245]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
The add_doubles_metadata function in libavcodec/tiff.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a negative or zero count value in a TIFF image, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6d1c5ea04af3e345232aa70c944de961061dab2d]
[http://www.ffmpeg.org/security.html]
The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=3e196e4def03c7a91423803402f84d638d316c33]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=68a0477bc0af026db971ddba22541029a9e8715b]
[http://www.ffmpeg.org/security.html]
[MDVSA-2014:227]
[GLSA-201603-06]
The avcodec_decode_audio4 function in libavcodec/utils.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 allows remote attackers to trigger memory corruption via vectors related to the channel layout.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=43c6b45a53a186a187f7266e4d6bd3c2620519f1]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4cd1dad91ae97fe1f0dd534c3f5566787566f137]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
Multiple integer overflows in the process_frame_obj function in libavcodec/sanm.c in FFmpeg before 1.1.2 allow remote attackers to have an unspecified impact via crafted image dimensions in LucasArts Smush video data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=f4fb841ad13bab66d4fb0c7ff2a94770df7815d8]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
Buffer overflow in the rle_decode function in libavcodec/sanm.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via crafted LucasArts Smush video data.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=62c9beda0c189db5cb61fa772057e3af9521f293]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=89e16e675d3cbe76cf4581f98bf4ac300cab0286]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The gif_copy_img_rect function in libavcodec/gifdec.c in FFmpeg before 1.1.2 performs an incorrect calculation for an "end pointer," which allows remote attackers to have an unspecified impact via crafted GIF data that triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=9547034f9120187e23ad76424dd4d70247e62212]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=08e2c7a45f82b897a285548c257972eb1ad352c5]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f3d16706060ab6ae6dc78f15359fab3fd87c9495]
[DSA-2855]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The aac_decode_init function in libavcodec/aacdec.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large number of channels in an AAC file, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=47e462eecc0a47ad40f59376199f93f227e21d13]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c459c7b23efffab762560e41ad6a2c0dbbfd4915]
[DSA-2793]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which allows remote attackers to have unspecified impact via crafted H.264 video data, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=3ef1538121fa6daeb1767510f1d4ae2c306c9fec]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6baa54924980e1f0e8121e4715d16ed1adcd2a23]
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=75e88db33013eaa7ab74457f5556df677b4ffb42]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=eaa9d2cd6b8c1e2722d5bfc56ea67fde865200ce]
[http://www.ffmpeg.org/security.html]
The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check.
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=14c8ee00ffd9d45e6e0c6f11a957ce7e56f7eb3a]
[[oss-security] 20140208 Fwd: Old CVE ids, public, but still "RESERVED"]
[https://www.ffmpeg.org/security.html]
Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9899d11f654474d2d54ea52ceaa2a1f4db3abd68]
[SUSE-SU-2013:0341]
[SUSE-SU-2013:0674]
[openSUSE-SU-2013:0925]
[RHSA-2013:0567]
[RHSA-2013:0661]
[RHSA-2013:0662]
[RHSA-2013:0695]
[DSA-2632]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5]
[[oss-security] 20130215 Linux kernel race condition with PTRACE_SETREGS (CVE-2013-0871)]
[USN-1736-1]
[USN-1737-1]
[USN-1738-1]
[USN-1739-1]
[USN-1740-1]
[USN-1741-1]
[USN-1742-1]
[USN-1743-1]
[USN-1744-1]
[USN-1745-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=911937]
[https://github.com/torvalds/linux/commit/9899d11f654474d2d54ea52ceaa2a1f4db3abd68]
The swr_init function in libswresample/swresample.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid or unsupported (1) input or (2) output channel layout, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=21cd905cd44a4bbafe8631bbaa6021d328413ce5]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=4f1279154ee9baf2078241bf5619774970d18b25]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The (1) doubles2str and (2) shorts2str functions in libavcodec/tiff.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via a crafted TIFF image, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=e1219cdaf9fb4bc8cea410e1caf802373c1bfe51]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The ff_add_png_paeth_prediction function in libavcodec/pngdec.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via a crafted PNG image, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=1ac0fa50eff30d413206cffa5f47f7fe6d4849b1]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
Multiple integer overflows in the (1) old_codec37 and (2) old_codec47 functions in libavcodec/sanm.c in FFmpeg before 1.1.3 allow remote attackers to have an unspecified impact via crafted LucasArts Smush data, which triggers an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5260edee7e5bd975837696c8c8c1a80eb2fbd7c1]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The old_codec37 function in libavcodec/sanm.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted LucasArts Smush data that has a large size when decoded, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=365270aec5c2b9284230abc702b11168818f14cf]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
The advance_line function in libavcodec/targa.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via crafted Targa image data, related to an out-of-bounds array access.
[http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=f5955d9f6f9ffdb81864c3de1c7b801782a55725]
[http://www.ffmpeg.org/security.html]
[GLSA-201603-06]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-09-18-2]
[openSUSE-SU-2013:0454]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[https://code.google.com/p/chromium/issues/detail?id=172243]
[oval:org.mitre.oval:def:16505]
Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=171951]
[oval:org.mitre.oval:def:16081]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via crafted data in the Matroska container format.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=167069]
[oval:org.mitre.oval:def:16473]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=165432]
[oval:org.mitre.oval:def:16468]
Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=142169]
[oval:org.mitre.oval:def:16499]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly load Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=172984]
[oval:org.mitre.oval:def:16101]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with the Chrome Web Store, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=172369]
[oval:org.mitre.oval:def:16255]
Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=171569]
The developer-tools process in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict privileges during interaction with a connected server, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=170836]
[https://code.google.com/p/chromium/issues/detail?id=171065]
[oval:org.mitre.oval:def:15788]
Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (out-of-bounds read) via vectors related to a "user gesture check for dangerous file downloads."
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=170666]
[oval:org.mitre.oval:def:16303]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly enforce a user gesture requirement before proceeding with a file download, which might make it easier for remote attackers to execute arbitrary code via a crafted file.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=170569]
[oval:org.mitre.oval:def:16233]
Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service (memory corruption) or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=169966]
[https://code.google.com/p/chromium/issues/detail?id=169973]
[oval:org.mitre.oval:def:16208]
Integer overflow in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a blob.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=169685]
[oval:org.mitre.oval:def:16356]
Multiple unspecified vulnerabilities in the IPC layer in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allow remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=164946]
[https://code.google.com/p/chromium/issues/detail?id=164958]
[https://code.google.com/p/chromium/issues/detail?id=165747]
[https://code.google.com/p/chromium/issues/detail?id=165836]
[https://code.google.com/p/chromium/issues/detail?id=166493]
[https://code.google.com/p/chromium/issues/detail?id=168710]
[https://code.google.com/p/chromium/issues/detail?id=169295]
[oval:org.mitre.oval:def:15586]
Race condition in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to media.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=168570]
[oval:org.mitre.oval:def:15682]
Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.
[http://git.chromium.org/gitweb/?p=chromium/deps/ffmpeg.git;a=commit;h=e1e70d9bb9852b7d099379afc95531a632a20ba5]
[http://git.videolan.org/?p=ffmpeg.git;a=commit;h=2c16bf2de07c68513072bf3cc96401d2c6291a3e]
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[USN-1790-1]
[https://code.google.com/p/chromium/issues/detail?id=168473]
Google Chrome before 25.0.1364.97 on Linux, and before 25.0.1364.99 on Mac OS X, does not properly handle pathnames during copy operations, which might make it easier for remote attackers to execute arbitrary programs via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=167840]
Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly manage memory during message handling for plug-ins, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=166708]
[oval:org.mitre.oval:def:16656]
Off-by-one error in the PDF functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service via a crafted document.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=165537]
[oval:org.mitre.oval:def:16153]
Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a URL.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[https://code.google.com/p/chromium/issues/detail?id=164643]
[oval:org.mitre.oval:def:16569]
Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[openSUSE-SU-2013:0454]
[http://opus-codec.org/downloads/]
[https://code.google.com/p/chromium/issues/detail?id=160480]
[https://codereview.chromium.org/11575026]
[oval:org.mitre.oval:def:16027]
[https://src.chromium.org/viewvc/chrome/trunk/deps/third_party/opus/src/opus_decoder.c?r1=173498&r2=173497&pathrev=173498]
[https://src.chromium.org/viewvc/chrome?view=rev&revision=173498]
Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html]
[JVN#70739377]
[openSUSE-SU-2013:0454]
[DSA-2786]
[https://code.google.com/p/chromium/issues/detail?id=152442]
[oval:org.mitre.oval:def:16404]
Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=176882]
[oval:org.mitre.oval:def:16439]
Use-after-free vulnerability in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of browser navigation.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=176252]
[oval:org.mitre.oval:def:16661]
The Web Audio implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=172331]
[https://code.google.com/p/chromium/issues/detail?id=172926]
[oval:org.mitre.oval:def:16042]
Use-after-free vulnerability in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an SVG animation.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=168982]
[oval:org.mitre.oval:def:16495]
The IndexedDB implementation in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=174895]
[oval:org.mitre.oval:def:16653]
Race condition in Google Chrome before 25.0.1364.152 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of media threads.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=174150]
[oval:org.mitre.oval:def:16633]
Google Chrome before 25.0.1364.152 does not properly manage bindings of extension processes, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=174059]
[oval:org.mitre.oval:def:16369]
The XSS Auditor in Google Chrome before 25.0.1364.152 allows remote attackers to obtain sensitive HTTP Referer information via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=173906]
[oval:org.mitre.oval:def:16132]
Google Chrome before 25.0.1364.152 does not properly manage the interaction between the browser process and renderer processes during authorization of the loading of a plug-in, which makes it easier for remote attackers to bypass intended access restrictions via vectors involving a blocked plug-in.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=172573]
[https://codereview.chromium.org/12086077]
[oval:org.mitre.oval:def:16574]
[https://src.chromium.org/viewvc/chrome?view=rev&revision=180103]
Directory traversal vulnerability in Google Chrome before 25.0.1364.152 allows remote attackers to have an unspecified impact via vectors related to databases.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_4.html]
[https://code.google.com/p/chromium/issues/detail?id=172264]
[oval:org.mitre.oval:def:16377]
WebKit in Google Chrome before 25.0.1364.160 allows remote attackers to execute arbitrary code via vectors that leverage "type confusion."
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_7.html]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[http://labs.mwrinfosecurity.com/blog/2013/03/06/pwn2own-at-cansecwest-2013/]
[APPLE-SA-2013-04-16-1]
[APPLE-SA-2013-03-19-1]
[http://support.apple.com/kb/HT5701]
[http://support.apple.com/kb/HT5704]
[http://twitter.com/thezdi/statuses/309460019131346944]
[https://code.google.com/p/chromium/issues/detail?id=180763]
[oval:org.mitre.oval:def:16274]
Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.
[http://git.chromium.org/gitweb/?p=chromiumos/third_party/kernel.git;a=commit;h=c79efdf2b7f68f985922a8272d64269ecd490477]
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[[oss-security] 20130311 CVE-2013-0913 Linux kernel i915 integer overflow]
[[oss-security] 20130313 Re: CVE-2013-0913 Linux kernel i915 integer overflow]
[[oss-security] 20130314 Re: CVE-2013-0913 Linux kernel i915 integer overflow]
[RHSA-2013:0744]
[USN-1809-1]
[USN-1811-1]
[USN-1812-1]
[USN-1813-1]
[USN-1814-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=920471]
[https://code.google.com/p/chromium-os/issues/detail?id=39733]
[https://gerrit.chromium.org/gerrit/45118]
[[linux-kernel] 20130311 [PATCH] drm/i915: bounds check execbuffer relocations]
The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2ca39528c01a933f6689cd6505ce65bd6d68a530]
[openSUSE-SU-2013:1187]
[openSUSE-SU-2013:1971]
[RHSA-2013:1051]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4]
[MDVSA-2013:176]
[[oss-security] 20130311 CVE-2013-0914 Linux kernel sa_restorer information leak]
[USN-1787-1]
[USN-1788-1]
[USN-1792-1]
[USN-1793-1]
[USN-1794-1]
[USN-1795-1]
[USN-1796-1]
[USN-1797-1]
[USN-1798-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=920499]
[https://github.com/torvalds/linux/commit/2ca39528c01a933f6689cd6505ce65bd6d68a530]
The GPU process in Google Chrome OS before 25.0.1364.173 allows attackers to cause a denial of service or possibly have unspecified other impact via vectors related to an "overflow."
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update-for-chrome-os_15.html]
[https://code.google.com/p/chromium/issues/detail?id=181083]
Use-after-free vulnerability in the Web Audio implementation in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=172342]
[oval:org.mitre.oval:def:16665]
The URL loader in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=180909]
[oval:org.mitre.oval:def:15892]
Google Chrome before 26.0.1410.43 does not prevent navigation to developer tools in response to a drag-and-drop operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=180555]
[oval:org.mitre.oval:def:16520]
Use-after-free vulnerability in Google Chrome before 26.0.1410.43 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging the presence of an extension that creates a pop-up window.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=178760]
Use-after-free vulnerability in the extension bookmarks API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=177410]
[oval:org.mitre.oval:def:16552]
The Isolated Sites feature in Google Chrome before 26.0.1410.43 does not properly enforce the use of separate processes, which makes it easier for remote attackers to bypass intended access restrictions via a crafted web site.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=174943]
[oval:org.mitre.oval:def:16670]
Google Chrome before 26.0.1410.43 does not properly restrict brute-force access attempts against web sites that require HTTP Basic Authentication, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=174129]
[oval:org.mitre.oval:def:16215]
The USB Apps API in Google Chrome before 26.0.1410.43 allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=169765]
[https://code.google.com/p/chromium/issues/detail?id=169972]
[https://code.google.com/p/chromium/issues/detail?id=169981]
[oval:org.mitre.oval:def:16671]
The extension functionality in Google Chrome before 26.0.1410.43 does not verify that use of the permissions API is consistent with file permissions, which has unspecified impact and attack vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=169632]
[oval:org.mitre.oval:def:16674]
Google Chrome before 26.0.1410.43 does not ensure that an extension has the tabs (aka APIPermission::kTab) permission before providing a URL to this extension, which has unspecified impact and remote attack vectors.
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[https://code.google.com/p/chromium/issues/detail?id=168442]
[oval:org.mitre.oval:def:16363]
Google Chrome before 26.0.1410.43 does not properly handle active content in an EMBED element during a copy-and-paste operation, which allows user-assisted remote attackers to have an unspecified impact via a crafted web site.
[http://git.chromium.org/gitweb/?p=chromium/src.git;a=commit;h=52a30db57ecec68bb3b25fdc3de5e9bee7b80ed7]
[http://googlechromereleases.blogspot.com/2013/03/stable-channel-update_26.html]
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[https://chromiumcodereview.appspot.com/11884025]
[https://code.google.com/p/chromium/issues/detail?id=112325]
[oval:org.mitre.oval:def:16601]
[https://src.chromium.org/viewvc/chrome?view=rev&revision=176856]
Google Chrome OS before 26.0.1410.57 relies on a Pango pango-utils.c read_config implementation that loads the contents of the .pangorc file in the user's home directory, and the file referenced by the PANGO_RC_FILE environment variable, which allows attackers to bypass intended access restrictions via crafted configuration data.
[http://git.chromium.org/gitweb/?p=chromiumos/overlays/chromiumos-overlay.git;a=commit;h=fb5a664def6cd34bf7295489ea73e1d989bdd6d0]
[http://googlechromereleases.blogspot.com/2013/04/chrome-os-stable-channel-update.html]
[https://code.google.com/p/chromium/issues/detail?id=189250]
The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.
[20130118 ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities]
[34756]
[57472]
[http://www.zerodayinitiative.com/advisories/ZDI-13-033/]
Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.
[20130118 ESA-2013-008: EMC AlphaStor Multiple Vulnerabilities]
[57472]
Buffer overflow in Drive Control Program (DCP) in EMC AlphaStor 4.0 before build 814 allows remote attackers to execute arbitrary code via vectors involving a new device name.
[20130128 ESA-2013-010: EMC AlphaStor Buffer Overflow Vulnerability]
EMC RSA Authentication Agent 7.1.x before 7.1.2 on Windows does not enforce the Quick PIN Unlock timeout feature, which allows physically proximate attackers to bypass the passcode requirement for a screensaved session by entering a PIN after timeout expiration.
Per http://archives.neohapsis.com/archives/bugtraq/2013-03/att-0001/ESA-2013-012.txt
"Affected Products:
Product: RSA Authentication Agent for Microsoft Windows version 7.1 and 7.1.1
Platforms: Windows XP and Windows 2003"
[20130228 ESA-2013-012: RSA Authentication Agent 7.1.1 for Microsoft Windows Access Control Vulnerability]
EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and upload arbitrary files via unspecified vectors.
[20130506 ESA-2013-015: RSA Archer GRC Multiple Vulnerabilities]
Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[20130506 ESA-2013-015: RSA Archer GRC Multiple Vulnerabilities]
EMC RSA Archer 5.x before GRC 5.3SP1, and Archer Smart Suite Framework 4.x, allows remote authenticated users to bypass intended access restrictions and modify global reports via unspecified vectors.
[20130506 ESA-2013-015: RSA Archer GRC Multiple Vulnerabilities]
EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls, which allows remote attackers to execute arbitrary code via unspecified vectors.
[20130326 ESA-2013-016: EMC Smarts Network Configuration Manager]
Cross-site scripting (XSS) vulnerability in EMC Smarts IP Manager, Smarts Service Assurance Manager, Smarts Server Manager, Smarts VoIP Availability Manager, Smarts Network Protocol Manager, and Smarts MPLS Manager before 9.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
[20130327 ESA-2013-018: EMC Smarts Product - Cross Site Scripting Vulnerability]
Session fixation vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to hijack web sessions via unspecified vectors.
[20130509 ESA-2013-021: EMC Documentum Multiple Vulnerabilities]
Cross-site scripting (XSS) vulnerability in EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[20130509 ESA-2013-021: EMC Documentum Multiple Vulnerabilities]
EMC Documentum Webtop before 6.7 SP2, Documentum WDK before 6.7 SP2, Documentum Taskspace before 6.7 SP2, and Documentum Records Manager before 6.7 SP2 allow remote attackers to obtain sensitive information via vectors involving cross-origin frame navigation, related to a "Cross Frame Scripting" issue.
[20130509 ESA-2013-021: EMC Documentum Multiple Vulnerabilities]
The nsrpush process in the client in EMC NetWorker before 7.6.5.3 and 8.x before 8.0.1.4 sets weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
[20130502 ESA-2013-028: EMC NetWorker Elevation of Privilege Vulnerability]
EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
Per: http://archives.neohapsis.com/archives/bugtraq/2013-05/att-0064/ESA-2013-029.txt
"RSA SecurID Sensitive Information Disclosure Vulnerability"
[20130516 ESA-2013-029: RSA SecurID Sensitive Information Disclosure Vulnerability]
Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[20130510 ESA-2013-031: RSA Authentication Agent Cross-Site Scripting (XSS) Vulnerability]
EMC NetWorker 7.6.x and 8.x before 8.1 allows local users to obtain sensitive configuration information by leveraging operating-system privileges to perform decryption with nsradmin.
[20130729 ESA-2013-033: EMC NetWorker Information Disclosure Vulnerability]
The web-based file-restore interface in EMC Avamar Server before 6.1.0 allows remote authenticated users to read arbitrary files via a crafted URL.
[20130502 ESA-2013-034: EMC Avamar Improper Authorization vulnerability]
EMC Avamar Client before 6.1.101-89 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
[20130502 ESA-2013-035: EMC Avamar Client Improper Certificate Validation Vulnerability]
Buffer overflow in the Library Control Program (LCP) in EMC AlphaStor 4.0 before build 910 allows remote attackers to execute arbitrary code via crafted commands.
http://archives.neohapsis.com/archives/bugtraq/2013-05/att-0035/ESA-2013-037.txt
[20130509 ESA-2013-037: EMC AlphaStor Buffer Overflow Vulnerability]
[59794]
[42719]
EMC RSA Authentication Manager 8.0 before P1 allows local users to discover cleartext operating-system passwords, HTTP plug-in proxy passwords, and SNMP communities by reading a (1) log file or (2) configuration file.
[20130528 ESA-2013-040: RSA Authentication Manager 8.0 Multiple Vulnerabilities]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
Data Protection in Apple iOS before 7 allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox.
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[1029054]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2013-0961.
[APPLE-SA-2013-03-14-2]
WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2013-0960.
[APPLE-SA-2013-03-14-2]
Cross-site scripting (XSS) vulnerability in WebKit in Apple iOS before 6.1 allows user-assisted remote attackers to inject arbitrary web script or HTML via crafted content that is not properly handled during a copy-and-paste operation.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-2]
[http://support.apple.com/kb/HT5642]
Identity Services in Apple iOS before 6.1 does not properly handle validation failures of AppleID certificates, which might allow physically proximate attackers to bypass authentication by leveraging an incorrect assignment of an empty string value to an AppleID.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-03-14-1]
[http://support.apple.com/kb/HT5642]
The kernel in Apple iOS before 6.1 and Apple TV before 5.2 does not properly validate copyin and copyout arguments, which allows local users to bypass intended pointer restrictions and access locations in the first kernel-memory page by specifying a length of less than one page.
[APPLE-SA-2013-01-28-1]
[APPLE-SA-2013-01-28-2]
[http://support.apple.com/kb/HT5642]
[http://support.apple.com/kb/HT5643]
[57595]
The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
[APPLE-SA-2013-03-14-1]
CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site.
[APPLE-SA-2013-03-14-1]
WebKit, as used in Apple iOS before 6.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-01-28-1.
[APPLE-SA-2013-01-28-1]
[http://support.apple.com/kb/HT5642]
Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard.
[APPLE-SA-2013-03-14-1]
Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL.
[APPLE-SA-2013-03-14-1]
Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted ink annotations in a PDF document.
[APPLE-SA-2013-03-14-1]
Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream.
[APPLE-SA-2013-03-14-1]
StoreKit in Apple iOS before 6.1 does not properly handle the disabling of JavaScript within the preferences configuration of Mobile Safari, which allows remote attackers to bypass intended access restrictions and execute JavaScript code via a web site with a Smart App Banner.
[APPLE-SA-2013-01-28-1]
[http://support.apple.com/kb/HT5642]
Buffer overflow in QuickDraw Manager in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PICT image.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted graphics image.
[APPLE-SA-2013-03-14-1]
dyld in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not properly manage the state of file loading for Mach-O executable files, which allows local users to bypass intended code-signing requirements via a file that contains overlapping segments.
[APPLE-SA-2013-03-19-1]
[APPLE-SA-2013-03-19-2]
[http://support.apple.com/kb/HT5702]
[http://support.apple.com/kb/HT5704]
The ARM prefetch abort handler in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 does not ensure that it has been invoked in an abort context, which makes it easier for local users to bypass the ASLR protection mechanism via crafted code.
[APPLE-SA-2013-03-19-1]
[APPLE-SA-2013-03-19-2]
[http://support.apple.com/kb/HT5702]
[http://support.apple.com/kb/HT5704]
lockdownd in Lockdown in Apple iOS before 6.1.3 does not properly consider file types during the permission-setting step of a backup restoration, which allows local users to change the permissions of arbitrary files via a backup that contains a pathname with a symlink.
[APPLE-SA-2013-03-19-1]
[http://support.apple.com/kb/HT5704]
The Passcode Lock implementation in Apple iOS before 6.1.3 does not properly manage the lock state, which allows physically proximate attackers to bypass an intended passcode requirement by leveraging an error in the emergency-call feature.
[APPLE-SA-2013-03-19-1]
[http://support.apple.com/kb/HT5704]
The IOUSBDeviceFamily driver in the USB implementation in the kernel in Apple iOS before 6.1.3 and Apple TV before 5.2.1 accesses pipe object pointers that originated in userspace, which allows local users to gain privileges via crafted code.
[APPLE-SA-2013-03-19-1]
[APPLE-SA-2013-03-19-2]
[http://support.apple.com/kb/HT5702]
[http://support.apple.com/kb/HT5704]
The Private Browsing feature in CFNetwork in Apple Mac OS X before 10.8.4 does not prevent storage of permanent cookies upon exit from Safari, which might allow physically proximate attackers to bypass cookie-based authentication by leveraging an unattended workstation.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
Stack consumption vulnerability in CoreAnimation in Apple Mac OS X before 10.8.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text glyph in a URL encountered by Safari.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
Directory Service in Apple Mac OS X through 10.6.8 allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted message.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
Disk Management in Apple Mac OS X before 10.8.4 does not properly authenticate attempts to disable FileVault, which allows local users to cause a denial of service (loss of encryption functionality) via an unspecified command line.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted enof atoms in a movie file.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[http://support.apple.com/kb/HT5784]
[oval:org.mitre.oval:def:16794]
Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted QTIF file.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[http://support.apple.com/kb/HT5784]
[oval:org.mitre.oval:def:16759]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FPX file.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[http://support.apple.com/kb/HT5784]
[oval:org.mitre.oval:def:16637]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MP3 file.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[http://support.apple.com/kb/HT5784]
[oval:org.mitre.oval:def:16831]
SMB in Apple Mac OS X before 10.8.4, when file sharing is enabled, allows remote authenticated users to create or modify files outside of a shared directory via unspecified vectors.
[APPLE-SA-2013-06-04-1]
[http://support.apple.com/kb/HT5784]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:16907]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17621]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17009]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17400]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17561]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17298]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-12-2]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5921]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17466]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17300]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:16762]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17396]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17572]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17187]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17252]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17604]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17601]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17143]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17441]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17359]
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1023.
[APPLE-SA-2013-06-04-2]
[http://support.apple.com/kb/HT5785]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:17123]
WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-05-16-1]
[http://support.apple.com/kb/HT5766]
[http://support.apple.com/kb/HT5785]
[oval:org.mitre.oval:def:17407]
Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 6.0.5 allows remote attackers to inject arbitrary web script or HTML via vectors involving IFRAME elements.
[APPLE-SA-2013-06-04-2]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5785]
[http://support.apple.com/kb/HT5934]
XSS Auditor in WebKit in Apple Safari before 6.0.5 does not properly rewrite URLs, which allows remote attackers to trigger unintended form submissions via unspecified vectors.
[APPLE-SA-2013-06-04-2]
[http://support.apple.com/kb/HT5785]
Apple iTunes before 11.0.3 does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
[APPLE-SA-2013-05-16-1]
[http://support.apple.com/kb/HT5766]
[oval:org.mitre.oval:def:17605]
Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted TeXML file.
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16237]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.263 encoding.
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16497]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted dref atoms in a movie file.
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16606]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
[APPLE-SA-2013-07-02-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16799]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.
[APPLE-SA-2013-07-02-1]
[APPLE-SA-2013-05-22-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5770]
[http://support.apple.com/kb/HT5934]
[oval:org.mitre.oval:def:16830]
Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted JPEG data in a movie file.
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16365]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG data in a movie file.
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16728]
Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted mvhd atoms in a movie file.
[APPLE-SA-2013-07-02-1]
[APPLE-SA-2013-05-22-1]
[http://support.apple.com/kb/HT5770]
[oval:org.mitre.oval:def:16838]
WebKit, as used in Apple Safari before 6.0.5, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2013-1009.
[APPLE-SA-2013-06-04-2]
[http://support.apple.com/kb/HT5785]
CoreMedia Playback in Apple Mac OS X before 10.8.4 does not properly initialize memory during the processing of text tracks, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-10-22-8]
[http://support.apple.com/kb/HT5784]
[http://support.apple.com/kb/HT6001]
Buffer overflow in CoreGraphics in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JBIG2 data in a PDF document.
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5934]
Buffer overflow in ImageIO in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted JPEG2000 data in a PDF document.
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5934]
Installer in Apple Mac OS X before 10.8.5 provides an option to continue a package's installation after encountering a revoked certificate, which might allow user-assisted remote attackers to execute arbitrary code via a crafted package.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
The IPSec implementation in Apple Mac OS X before 10.8.5, when Hybrid Auth is used, does not verify X.509 certificates from security gateways, which allows man-in-the-middle attackers to spoof security gateways and obtain sensitive information via a crafted certificate.
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5934]
The kernel in Apple Mac OS X before 10.8.5 allows remote attackers to cause a denial of service (panic) via crafted IGMP packets that leverage incorrect, extraneous code in the IGMP parser.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
mdmclient in Mobile Device Management in Apple Mac OS X before 10.8.5 places a password on the command line, which allows local users to obtain sensitive information by listing the process.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
Power Management in Apple Mac OS X before 10.8.5 does not properly perform locking upon occurrences of a power assertion, which allows physically proximate attackers to bypass intended access restrictions by visiting an unattended workstation on which a locking failure had prevented the startup of the screen saver.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
QuickTime in Apple Mac OS X before 10.8.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted idsc atom in a QuickTime movie file.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT6151]
Screen Lock in Apple Mac OS X before 10.8.5 does not properly track sessions, which allows remote authenticated users to bypass locking by leveraging screen-sharing access.
[APPLE-SA-2013-09-12-1]
[http://support.apple.com/kb/HT5880]
Multiple cross-site scripting (XSS) vulnerabilities in Wiki Server in Apple Mac OS X Server before 2.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[APPLE-SA-2013-09-17-1]
[http://support.apple.com/kb/HT5892]
[http://www.cloudscan.me/2013/09/cve-2013-1034-stored-xss-xxe-os-x.html]
The iTunes ActiveX control in Apple iTunes before 11.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
[APPLE-SA-2013-09-18-1]
[http://support.apple.com/kb/HT5936]
[oval:org.mitre.oval:def:18997]
Safari in Apple iOS before 7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted XML document.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
WebKit, as used in Apple iOS before 7, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-09-18-2.
[APPLE-SA-2013-10-22-2]
[APPLE-SA-2013-10-22-8]
[APPLE-SA-2013-09-18-2]
[http://support.apple.com/kb/HT5934]
[http://support.apple.com/kb/HT6001]
[1029054]
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.
[http://security.debian.org/debian-security/pool/updates/main/a/apache2/apache2_2.2.16-6+squeeze11.diff.gz]
[DSA-2637]
Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700098]
[DSA-2635]
[https://bugs.launchpad.net/ubuntu/+source/cfingerd/+bug/1104425]
The default configuration in gnome-screensaver 3.5.4 through 3.6.0 sets the AutostartCondition line to fallback mode in the .desktop file, which prevents the program from starting automatically after login and allows physically proximate attackers to bypass screen locking and access an unattended workstation.
[USN-1716-1]
[https://bugs.launchpad.net/ubuntu/+source/gnome-screensaver/+bug/1120126]
[https://bugzilla.gnome.org/show_bug.cgi?id=683060]
[https://git.gnome.org/browse/gnome-screensaver/commit/?id=1940dc6bc8ad5ee2c029714efb1276c05ca80bd4]
apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.
Per http://www.ubuntu.com/usn/USN-1762-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
"
[USN-1762-1]
pam-xdg-support, as used in Ubuntu 12.10, does not properly handle the PATH environment variable, which allows local users to gain privileges via unspecified vectors related to sudo.
[58550]
[USN-1766-1]
[ubuntu-cve20131052-priv-esc(82918)]
X.org X server 1.13.3 and earlier, when not run as root, allows local users to cause a denial of service (crash) or possibly gain privileges via vectors involving cached xkb files.
[USN-1990-1]
Untrusted search path vulnerability in maas-import-pxe-files in MAAS before 13.10 allows local users to execute arbitrary code via a Trojan horse import_pxe_files configuration file in the current working directory.
[USN-2013-1]
[https://bugs.launchpad.net/maas/+bug/1158425]
[https://launchpad.net/maas/+milestone/13.10]
maas-import-pxe-files in MAAS before 13.10 does not verify the integrity of downloaded files, which allows remote attackers to modify these files via a man-in-the-middle (MITM) attack.
[USN-2013-1]
[https://bugs.launchpad.net/maas/%2Bbug/1039513]
[https://launchpad.net/maas/+milestone/13.10]
net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[http://hkpco.kr/advisory/CVE-2013-1059.txt]
[SUSE-SU-2013:1161]
[SUSE-SU-2013:1473]
[SUSE-SU-2013:1474]
[openSUSE-SU-2013:1971]
[[oss-security] 20130709 Linux kernel libceph NULL function pointer dereference (CVE-2013-1059)]
[USN-1941-1]
[USN-1942-1]
[https://bugzilla.redhat.com/attachment.cgi?id=767633&action=diff]
[https://bugzilla.redhat.com/show_bug.cgi?id=977356]
A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.
[http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1060.html]
[USN-1938-1]
[USN-1939-1]
[USN-1941-1]
[USN-1942-1]
[USN-1943-1]
[USN-1944-1]
[USN-1945-1]
[USN-1946-1]
[USN-1947-1]
[[kernel-team] 20130731 [CVE-2013-1060] perf configuration file vunerability]
[[kernel-team] 20130731 [lucid CVE 1/1] UBUNTU: [Packaging] supply perf with appropriate prefix to ensure use of local config]
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[http://launchpadlibrarian.net/150156695/software-properties_0.92.17.2_0.92.17.3.diff.gz]
[USN-1960-1]
[softwareproperties-cve20131061-sec-bypass(87381)]
[https://launchpad.net/ubuntu/+source/software-properties/0.82.7.5]
[https://launchpad.net/ubuntu/+source/software-properties/0.92.17.3]
[https://launchpad.net/ubuntu/+source/software-properties/0.92.9.3]
ubuntu-system-service 0.2.4 before 0.2.4.1. 0.2.3 before 0.2.3.1, and 0.2.2 before 0.2.2.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[USN-1962-1]
usb-creator 0.2.47 before 0.2.47.1, 0.2.40 before 0.2.40ubuntu2, and 0.2.38 before 0.2.38.2 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[USN-1963-1]
[https://launchpad.net/ubuntu/+source/usb-creator/0.2.38.2]
[https://launchpad.net/ubuntu/+source/usb-creator/0.2.40ubuntu2]
[https://launchpad.net/ubuntu/+source/usb-creator/0.2.47.1]
apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[USN-1955-1]
[https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu5.1]
[https://launchpad.net/ubuntu/+source/apt-xapian-index/0.44ubuntu7.1]
[https://launchpad.net/ubuntu/+source/apt-xapian-index/0.45ubuntu2.1]
backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[USN-1957-1]
[https://launchpad.net/ubuntu/+source/jockey/0.9.7-0ubuntu7.11]
language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0.79.x before 0.79.4 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.
[USN-1958-1]
[languageselector-cve20131066-sec-bypass(87379)]
[https://launchpad.net/ubuntu/+source/language-selector/0.110.1]
[https://launchpad.net/ubuntu/+source/language-selector/0.79.4]
[https://launchpad.net/ubuntu/+source/language-selector/0.90.1]
Apport 2.12.5 and earlier uses weak permissions for core dump files created by setuid binaries, which allows local users to obtain sensitive information by reading the file.
[USN-2007-1]
The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.
[USN-2248-1]
[USN-2247-1]
Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 uses world-readable permissions for txlongpoll.yaml, which allows local users to obtain RabbitMQ authentication credentials by reading the file.
[USN-2105-1]
[https://bugs.launchpad.net/ubuntu/%2Bsource/maas/%2Bbug/1254034]
Cross-site scripting (XSS) vulnerability in the API in Ubuntu Metal as a Service (MaaS) 1.2 and 1.4 allows remote attackers to inject arbitrary web script or HTML via the op parameter to nodes/.
[65575]
[USN-2105-1]
[https://bugs.launchpad.net/maas/%2Bbug/1251336]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Directory traversal vulnerability in the ISCreateObject method in an ActiveX control in InstallShield\ISProxy.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.3 through 11.2 allows remote attackers to execute arbitrary local DLL files via a crafted web page that also calls the Initialize method.
[http://www.novell.com/support/kb/doc.php?id=7011811]
[http://www.zerodayinitiative.com/advisories/ZDI-13-048/]
The web server in Novell ZENworks Configuration Management (ZCM) 10.3 and 11.2 before 11.2.4 does not properly perform authentication for zenworks/jsp/index.jsp, which allows remote attackers to conduct directory traversal attacks, and consequently upload and execute arbitrary programs, via a request to TCP port 443.
[24938]
[http://www.novell.com/support/kb/doc.php?id=7011812]
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.zerodayinitiative.com/advisories/ZDI-13-049/]
Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.
[http://www.novell.com/support/kb/doc.php?id=7011895]
Directory traversal vulnerability in DUSAP.php in Novell ZENworks Mobile Management before 2.7.1 allows remote attackers to include and execute arbitrary local files via the language parameter.
[http://www.novell.com/support/kb/doc.php?id=7011896]
Unspecified vulnerability in the login functionality in the Reporting Module in Novell Identity Manager (aka IDM) Roles Based Provisioning Module 4.0.2 before Field Patch C has unknown impact and attack vectors.
[http://download.novell.com/Download?buildid=nbGXg-msbmw~]
[https://bugzilla.novell.com/show_bug.cgi?id=807193]
Directory traversal vulnerability in the GetFle method in the umaninv service in Novell ZENworks Configuration Management (ZCM) 11.2.3 allows remote attackers to read arbitrary files via a .. (dot dot) in the Filename parameter in a GetFile action to zenworks-unmaninv/.
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.novell.com/support/kb/doc.php?id=7012760]
Stack-based buffer overflow in the nim: protocol handler in Novell GroupWise Messenger 2.04 and earlier, and Novell Messenger 2.1.x and 2.2.x before 2.2.2, allows remote attackers to execute arbitrary code via an import command containing a long string in the filename parameter.
Per http://www.novell.com/support/kb/doc.php?id=7011935
Affected versions:
Novell Messenger 2.2.1 (and earlier)
Novell Messenger 2.1 (and earlier)
GroupWise Messenger 2.04 (and earlier)
[http://www.novell.com/support/kb/doc.php?id=7011935]
[http://www.zerodayinitiative.com/advisories/ZDI-13-036/]
[https://bugzilla.novell.com/show_bug.cgi?id=777352]
Cross-site scripting (XSS) vulnerability in WebAccess in Novell GroupWise before 8.0.3 HP3, and 2012 before SP2, allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError attribute.
[http://www.novell.com/support/kb/doc.php?id=7012064]
[https://bugzilla.novell.com/show_bug.cgi?id=802906]
Cross-site scripting (XSS) vulnerability in the client in Novell GroupWise through 8.0.3 HP3, and 2012 through SP2, on Windows allows user-assisted remote attackers to inject arbitrary web script or HTML via the body of an e-mail message.
Per: http://www.novell.com/support/kb/doc.php?id=7012063
'Previous versions (GroupWise, 6.5, 7.x) of the GroupWise Client for Windows are likely also vulnerable but are no longer supported. Customers on earlier versions of GroupWise should, at a minimum, upgrade their GroupWise Windows clients to version 8.0.3 Hot Patch 3 or 2012 SP2 in order to secure their systems.'
[http://www.novell.com/support/kb/doc.php?id=7012063]
[https://bugzilla.novell.com/show_bug.cgi?id=799673]
Cross-site request forgery (CSRF) vulnerability in Novell iManager 2.7 before SP6 Patch 1 allows remote attackers to hijack the authentication of arbitrary users by leveraging improper request validation by iManager code deployed within an Apache Tomcat container.
[http://www.novell.com/support/kb/doc.php?id=7010166]
[https://bugzilla.novell.com/show_bug.cgi?id=726260]
The SUSE horde5 package before 5.0.2-2.4.1 sets incorrect ownership for certain configuration files and directories including /etc/apache2/vhosts.d, which allows local wwwrun users to gain privileges via unspecified vectors.
[openSUSE-SU-2013:1826]
[https://bugzilla.novell.com/show_bug.cgi?id=811369]
Stack-based buffer overflow in Novell iPrint Client before 5.90 allows remote attackers to execute arbitrary code via unspecified vectors.
[http://download.novell.com/Download?buildid=k6yH0sy992E~]
[http://www.novell.com/support/kb/doc.php?id=7012344]
[59612]
[https://bugzilla.novell.com/show_bug.cgi?id=800593]
Multiple unquoted Windows search path vulnerabilities in Novell ZENworks Desktop Management (ZDM) 7 through 7.1 might allow local users to gain privileges via a Trojan horse "program" file in the C: folder, related to an attempted launch of (1) ZenRem32.exe or (2) wm.exe.
[http://download.novell.com/Download?buildid=hT-LlTRPOfw~]
[http://www.novell.com/support/kb/doc.php?id=7012147]
Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter.
[http://www.novell.com/support/kb/doc.php?id=7012025]
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.novell.com/support/kb/doc.php?id=7012499]
Cross-site scripting (XSS) vulnerability in a ZCC page in zenworks-core in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via an invalid locale.
[http://www.novell.com/support/kb/doc.php?id=7012025]
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.novell.com/support/kb/doc.php?id=7012501]
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onError event.
[http://www.novell.com/support/kb/doc.php?id=7012025]
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.novell.com/support/kb/doc.php?id=7012500]
Cross-site scripting (XSS) vulnerability in the Roles Based Provisioning Module 4.0.2 before Field Patch D for Novell Identity Manager (aka IDM) allows remote attackers to inject arbitrary web script or HTML via a taskDetail taskId.
[http://download.novell.com/Download?buildid=dnDbmYe8PZc~]
[1029532]
[https://bugzilla.novell.com/show_bug.cgi?id=819115]
Cross-site scripting (XSS) vulnerability in a ZCC page in njwc.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to inject arbitrary web script or HTML via vectors involving an onload event.
[http://www.novell.com/support/kb/doc.php?id=7012025]
[http://www.novell.com/support/kb/doc.php?id=7012027]
[http://www.novell.com/support/kb/doc.php?id=7012502]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
The HTTP server in Cisco IOS on Catalyst switches does not properly handle TCP socket events, which allows remote attackers to cause a denial of service (device crash) via crafted packets on TCP port (1) 80 or (2) 443, aka Bug ID CSCuc53853.
[20130130 Cisco IOS Software HTTP Server Denial of Service Vulnerability]
The Wireless Intrusion Prevention System (wIPS) component on Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.0, 7.1 and 7.2 before 7.2.110.0, and 7.3 before 7.3.101.0 allows remote attackers to cause a denial of service (device reload) via crafted IP packets, aka Bug ID CSCtx80743.
[20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[57524]
[1028027]
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (Access Point reload) via crafted SIP packets, aka Bug ID CSCts87659.
[20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[57524]
[1028027]
The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header, aka Bug ID CSCuc15636.
[20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[57524]
[1028027]
[cisco-wlc-profiling-code-exec(81489)]
Cisco Wireless LAN Controller (WLC) devices with software 7.0 before 7.0.235.3, 7.1 and 7.2 before 7.2.111.3, and 7.3 before 7.3.101.0 allow remote authenticated users to bypass wireless-management settings and read or modify the device configuration via an SNMP request, aka Bug ID CSCua60653.
[20130123 Multiple Vulnerabilities in Cisco Wireless LAN Controllers]
[57524]
[1028027]
[cisco-wlc-unauth-access(81490)]
The search function in Cisco Webex Social (formerly Cisco Quad) allows remote authenticated users to read files via unspecified parameters, aka Bug ID CSCud40235.
[20130113 Cisco Webex Social Information Disclosure Vulnerability]
Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.
[20130115 Cisco WebEx Cancel Hands-on Lab Session Reservation]
[1028014]
Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067.
[20130114 Cross-Site Request Forgery Vulnerability in testingLibraryAction.do]
[1028016]
Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065.
[20130116 Cisco WebEx Enable/Disable Availability of Recordings]
[57488]
[1028013]
The Cisco ATA 187 Analog Telephone Adaptor with firmware 9.2.1.0 and 9.2.3.1 before ES build 4 does not properly implement access control, which allows remote attackers to execute operating-system commands via vectors involving a session on TCP port 7870, aka Bug ID CSCtz67038.
[20130206 Cisco ATA 187 Analog Telephone Adaptor Remote Access Vulnerability]
Cisco Carrier Routing System (CRS) allows remote attackers to cause a denial of service (packet loss) via short malformed packets that trigger inefficient processing, aka Bug ID CSCud79136.
[20130125 Cisco Carrier Routing System Small Packets Denial of Service Vulnerability]
[57604]
Cross-site scripting (XSS) vulnerability in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via a crafted parameter value, aka Bug ID CSCue21042.
[20130125 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability]
[57567]
[cucdm-unspec-xss(81529)]
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud87527.
[20130201 Cisco Unity Express Cross Site Scripting Vulnerabilities]
Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted ARF file, aka Bug IDs CSCue74118, CSCub28371, CSCud23401, and CSCud31109.
[20130904 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in Cisco WebEx Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted ARF file, aka Bug IDs CSCue74147 and CSCub28383.
[20130904 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in the exception handler in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted WRF file, aka Bug ID CSCuc27639.
[20130904 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Stack-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code via a crafted WRF file, aka Bug ID CSCuc27645.
[20130904 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T27 L10N before SP32_ORION111, and T28 before T28.8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DHT index value in JPEG data within a WRF file, aka Bug ID CSCuc24503.
[20130904 Multiple Vulnerabilities in the Cisco WebEx Recording Format and Advanced Recording Format Players]
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Unity Express with software before 8.0 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCue35910.
[20130201 Cisco Unity Express Cross Site Request Forgery Vulnerabilities]
The regex engine in the BGP implementation in Cisco NX-OS, when a complex regular expression is configured for inbound routes, allows remote attackers to cause a denial of service (device reload) via a crafted AS path set, aka Bug ID CSCuf49554.
[20130917 Cisco NX-OS Software BGP Regex Vulnerability]
Cisco NX-OS on the Nexus 7000, when a certain Overlay Transport Virtualization (OTV) configuration is used, allows remote attackers to cause a denial of service (M1-Series module reload) via crafted packets, aka Bug ID CSCud15673.
[20130206 Cisco Nexus 7000 M1-Series Modules Crafted Packet Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in the server in Cisco Unified MeetingPlace 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuc65411 and CSCue18706.
[20130207 Cisco Unified MeetingPlace Server Cross-Site Scripting Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=28228]
[57885]
[cisco-meetingplace-unspec-xss(81986)]
The Cisco Network Admission Control (NAC) agent on Mac OS X does not verify the X.509 certificate of an Identity Services Engine (ISE) server during an SSL session, which allows man-in-the-middle attackers to spoof ISE servers via an arbitrary certificate, aka Bug ID CSCub24309.
[20130227 Cisco Network Admission Control Mac Agent Connects to ISE Server with Untrusted SSL Certificate]
The command-line interface in Cisco Identity Services Engine Software, Secure Access Control System (ACS), Application Networking Manager (ANM), Prime LAN Management Solution (LMS), Prime Network Control System, Quad, Context Directory Agent, Prime Collaboration, Unified Provisioning Manager, and Network Services Manager does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCue46001, CSCud95790, CSCue46021, CSCue46025, CSCue46023, CSCue46058, CSCue46013, CSCue46031, CSCue46035, and CSCue46042.
[20130215 Multiple Cisco Product Root Shell Access Vulnerability]
Multiple cross-site request forgery (CSRF) vulnerabilities in the server in Cisco Unified MeetingPlace before 7.1(2.2000) allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, aka Bug ID CSCuc64903. NOTE: some of these details are obtained from third party information.
[20130211 Cisco Unified MeetingPlace Server Cross-Site Request Forgery Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=28217]
Memory leak in Cisco Unity Connection 9.x allows remote attackers to cause a denial of service (memory consumption and process crash) by sending many TCP requests, aka Bug ID CSCud59736.
[20130215 Cisco Unity Connection Memory Leak Denial of Service Vulnerability]
Cisco AnyConnect Secure Mobility Client on Mac OS X uses weak permissions for a library directory, which allows local users to gain privileges via a crafted library file, aka Bug ID CSCue33619.
[20130919 Cisco AnyConnect Secure Mobility Client Local Privilege Escalation Vulnerability]
Cisco Small Business Wireless Access Points WAP200, WAP2000, WAP200E, and WET200 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted SSID that is not properly handled during a site survey, aka Bug IDs CSCua86182, CSCua91196, CSCud36155, and CSCua86190.
[20130213 Cisco Small Business Wireless Access Points SSID Validation Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unified Communications Domain Manager allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) IptAccountMgmt, (2) IptFeatureConfigTemplateMgmt, (3) IptFeatureDisplayPolicyMgmt, or (4) IptProviderMgmt page, aka Bug IDs CSCud69972, CSCud70193, and CSCud70261.
[20130710 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability]
Cisco Unified Communications Manager (CUCM) 8.6 before 8.6(2a)su2, 8.6 BE3k before 8.6(4) BE3k, and 9.x before 9.0(1) allows remote attackers to cause a denial of service (CPU consumption and GUI and voice outages) via malformed packets to unused UDP ports, aka Bug ID CSCtx43337.
[20130227 Cisco Unified Communications Manager Multiple Denial of Service Vulnerabilities]
The Location Bandwidth Manager (LBM) Intracluster-communication feature in Cisco Unified Communications Manager (CUCM) 9.x before 9.1(1) does not require authentication from the remote LBM Hub node, which allows remote attackers to conduct cache-poisoning attacks against transaction records, and cause a denial of service (bandwidth-pool consumption and call outage), via unspecified vectors, aka Bug ID CSCub28920.
[20130227 Cisco Unified Communications Manager Multiple Denial of Service Vulnerabilities]
Cisco Prime Central for Hosted Collaboration Solution (HCS) Assurance 8.6 and 9.0 allows remote attackers to cause a denial of service (CPU consumption and monitoring outage) via malformed TLS messages to TCP port (1) 9043 or (2) 9443, aka Bug ID CSCuc07155.
[20130227 Cisco Prime Central for Hosted Collaboration Solution Assurance Excessive CPU Utilization Vulnerability]
[20130227 Cisco Prime Central for Hosted Collaboration Solution Assurance Excessive CPU Utilization Issue]
The crypto engine process in Cisco IOS on Aggregation Services Router (ASR) Route Processor 2 does not properly manage memory, which allows local users to cause a denial of service (route processor crash) by creating multiple tunnels and then examining encryption statistics, aka Bug ID CSCuc52193.
[20130510 Cisco ASR Route Processor 2 Dynamic Multipoint Virtual Private Network Vulnerability]
Cisco Unified Presence Server (CUPS) 8.6, 9.0, and 9.1 before 9.1.1 allows remote attackers to cause a denial of service (CPU consumption) via crafted packets to the SIP TCP port, aka Bug ID CSCua89930.
[20130227 Cisco Unified Presence Server Denial of Service Vulnerability]
The NAT process on Cisco Adaptive Security Appliances (ASA) devices allows remote attackers to cause a denial of service (connections-table memory consumption) via crafted packets, aka Bug ID CSCue46386.
[20130225 Cisco ASA Connections Table Exhaustion Vulnerability]
The nsAPI interface in Cisco Cloud Portal 9.1 SP1 and SP2, and 9.3 through 9.3.2, does not properly check privileges, which allows remote authenticated users to obtain sensitive information via a crafted URL, aka Bug ID CSCud81134.
[20130225 Cisco Cloud Portal Information Disclosure Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=28387]
The XML parser in Cisco Security Monitoring, Analysis, and Response System (MARS) allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCue55093.
[20130304 Cisco MARS Information Disclosure Vulnerability]
The mDNS snooping functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.4.1.54 and earlier does not properly manage buffers, which allows remote authenticated users to cause a denial of service (device reload) via crafted mDNS packets, aka Bug ID CSCue04153.
[20130227 Cisco Wireless LAN Controller Denial of Service Vulnerability]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=28417]
Race condition in the VRF-aware NAT feature in Cisco IOS 12.2 through 12.4 and 15.0 through 15.2 allows remote attackers to cause a denial of service (memory consumption) via IPv4 packets, aka Bug IDs CSCtg47129 and CSCtz96745.
[20130327 Cisco IOS Software Network Address Translation Vulnerability]
[20130327 Cisco IOS Software VRF-Aware NAT Memory Starvation Vulnerability]
The RSVP protocol implementation in Cisco IOS 12.2 and 15.0 through 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S, when MPLS-TE is enabled, allows remote attackers to cause a denial of service (incorrect memory access and device reload) via a traffic engineering PATH message in an RSVP packet, aka Bug ID CSCtg39957.
[20130327 Cisco IOS Software Resource Reservation Protocol Denial of Service Vulnerability]
[20130327 Cisco IOS Software RSVP Denial of Service Vulnerability]
Memory leak in the IKEv1 implementation in Cisco IOS 15.1 allows remote attackers to cause a denial of service (memory consumption) via unspecified (1) IPv4 or (2) IPv6 IKE packets, aka Bug ID CSCth81055.
[20130327 Cisco IOS Software Internet Key Exchange Vulnerability]
Memory leak in Cisco IOS 12.2, 12.4, 15.0, and 15.1, when Zone-Based Policy Firewall SIP application layer gateway inspection is enabled, allows remote attackers to cause a denial of service (memory consumption or device reload) via malformed SIP messages, aka Bug ID CSCtl99174.
[20130327 Cisco IOS Software Zone-Based Policy Firewall Session Initiation Protocol Inspection Denial of Service Vulnerability]
The Smart Install client functionality in Cisco IOS 12.2 and 15.0 through 15.3 on Catalyst switches allows remote attackers to cause a denial of service (device reload) via crafted image list parameters in Smart Install packets, aka Bug ID CSCub55790.
[20130327 Cisco IOS Software Smart Install Denial of Service Vulnerability]
The Protocol Translation (PT) functionality in Cisco IOS 12.3 through 12.4 and 15.0 through 15.3, when one-step port-23 translation or a Telnet-to-PAD ruleset is configured, does not properly validate TCP connection information, which allows remote attackers to cause a denial of service (device reload) via an attempted connection to a PT resource, aka Bug ID CSCtz35999.
[20130327 Cisco IOS Software Protocol Translation Vulnerability]
The General Responder implementation in the IP Service Level Agreement (SLA) feature in Cisco IOS 15.2 and IOS XE 3.1.xS through 3.4.xS before 3.4.5S and 3.5.xS through 3.7.xS before 3.7.2S allows remote attackers to cause a denial of service (device reload) via crafted (1) IPv4 or (2) IPv6 IP SLA packets on UDP port 1167, aka Bug ID CSCuc72594.
[20130327 Cisco IOS Software IP Service Level Agreement Vulnerability]
Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.28), 8.1 and 8.2 before 8.2(5.35), 8.3 before 8.3(2.34), 8.4 before 8.4(4.11), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3), and Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(24.1) and 4.0 and 4.1 before 4.1(11.1), allow remote attackers to cause a denial of service (device reload) via a crafted IKEv1 message, aka Bug IDs CSCub85692 and CSCud20267.
[20130410 Multiple Vulnerabilities in Cisco ASA Software]
[20130410 Multiple Vulnerabilities in Cisco Firewall Services Module Software]
The authentication-proxy implementation on Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5.3), 8.5 and 8.6 before 8.6(1.10), 8.7 before 8.7(1.4), 9.0 before 9.0(1.1), and 9.1 before 9.1(1.2) allows remote attackers to cause a denial of service (device reload) via a crafted URL, aka Bug ID CSCud16590.
[20130410 Multiple Vulnerabilities in Cisco ASA Software]
[20130410 Crafted URL Denial of Service Vulnerability]
Cisco Adaptive Security Appliances (ASA) devices with software 7.x before 7.2(5.10), 8.0 before 8.0(5.31), 8.1 and 8.2 before 8.2(5.38), 8.3 before 8.3(2.37), 8.4 before 8.4(5), 8.5 before 8.5(1.17), 8.6 before 8.6(1.10), and 8.7 before 8.7(1.3) allow remote attackers to cause a denial of service (device reload) via a crafted certificate, aka Bug ID CSCuc72408.
[20130410 Multiple Vulnerabilities in Cisco ASA Software]
Cisco Adaptive Security Appliances (ASA) devices with software 9.0 before 9.0(1.2) allow remote attackers to cause a denial of service (device reload) via a crafted field in a DNS message, aka Bug ID CSCuc80080.
[20130410 Multiple Vulnerabilities in Cisco ASA Software]
Cross-site request forgery (CSRF) vulnerability in the web interface in Cisco Prime Infrastructure allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCue84676.
[20130305 Cisco Prime Infrastructure CSRF Vulnerability]
The Cisco Small Business 200 Series Smart Switch 1.2.7.76 and earlier, Small Business 300 Series Managed Switch 1.2.7.76 and earlier, and Small Business 500 Series Stackable Managed Switch 1.2.7.76 and earlier allow remote attackers to cause a denial of service (SSL/TLS layer outage) via malformed (1) SSH or (2) SSL packets, aka Bug ID CSCua30246.
[JVN#05132866]
[JVNDB-2013-000017]
[http://tools.cisco.com/security/center/viewAlert.x?alertId=27502]
The auth-proxy functionality in Cisco Firewall Services Module (FWSM) software 3.1 and 3.2 before 3.2(20.1), 4.0 before 4.0(15.2), and 4.1 before 4.1(5.1) allows remote attackers to cause a denial of service (device reload) via a crafted URL, aka Bug ID CSCtg02624.
[20130410 Multiple Vulnerabilities in Cisco Firewall Services Module Software]
Directory traversal vulnerability in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to read arbitrary files via a crafted URL, aka Bug ID CSCud51034.
[20130430 Cisco Prime Central for Hosted Collaboration Solution Directory Traversal Vulnerability]
Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) Java servlet container in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud51068.
[20130430 Cisco Prime Central for Hosted Collaboration Solution ITM Java Servlet Container Cross-Site Scripting Vulnerability]
Cross-site scripting (XSS) vulnerability in the IBM Tivoli Monitoring (ITM) help menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud54397.
[20130430 Cisco Prime Central for Hosted Collaboration Solution ITM Help Menus Cross-Site Scripting Vulnerability]
Cross-site scripting (XSS) vulnerability in the Netcool Impact (NCI) web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56706.
[20130430 Cisco Prime Central for Hosted Collaboration Solution NCI Web Menus Cross-Site Scripting Vulnerability]
Cross-site scripting (XSS) vulnerability in the OpenView web menus in Cisco Prime Central for Hosted Collaboration Solution allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCud56743.
[20130430 Cisco Prime Central for Hosted Collaboration Solution OpenView Web Menus Cross-Site Scripting Vulnerability]
The XML parser in the Cisco Jabber IM application for Android allows remote authenticated users to cause a denial of service (blocked connection) by leveraging an entry on a Buddy list and sending a crafted XMPP presence update message, aka Bug ID CSCue38383.
[20130319 Cisco Jabber IM for Android Denial of Service Vulnerability]
The traffic engineering (TE) processing subsystem in Cisco IOS XR allows remote attackers to cause a denial of service (process restart) via crafted TE packets, aka Bug ID CSCue04000.
[20130315 Cisco IOS XR Traffic Engineering Denial of Service Vulnerability]
Multiple SQL injection vulnerabilities in the device-management implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug IDs CSCue14553 and CSCue38746.
[20130401 Cisco Connected Grid Network Management System SQL Injection Vulnerabilities]
Cisco IOS XE 3.4 before 3.4.4S, 3.5, and 3.6 on 1000 series Aggregation Services Routers (ASR) does not properly implement the Cisco Multicast Leaf Recycle Elimination (MLRE) feature, which allows remote attackers to cause a denial of service (card reload) via fragmented IPv6 multicast packets, aka Bug ID CSCtz97563.
[20130410 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers]
Cisco IOS XE 2.x and 3.x before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR) allows remote attackers to cause a denial of service (card reload) by sending many crafted L2TP packets, aka Bug ID CSCtz23293.
[20130410 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers]
Cisco IOS XE 3.2 through 3.4 before 3.4.5S, and 3.5 through 3.7 before 3.7.1S, on 1000 series Aggregation Services Routers (ASR), when VRF-aware NAT and SIP ALG are enabled, allows remote attackers to cause a denial of service (card reload) by sending many SIP packets, aka Bug ID CSCuc65609.
[20130410 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers]
Cisco IOS XE 3.2 through 3.4 before 3.4.2S, and 3.5, on 1000 series Aggregation Services Routers (ASR), when bridge domain interface (BDI) is enabled, allows remote attackers to cause a denial of service (card reload) via packets that are not properly handled during the processing of encapsulation, aka Bug ID CSCtt11558.
[20130410 Multiple Vulnerabilities in Cisco IOS XE Software for 1000 Series Aggregation Services Routers]
The web server in Cisco Unified MeetingPlace Application Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 1, and 8.5 before 8.5MR3 Patch 1 does not invalidate a session upon a logout action, which makes it easier for remote attackers to hijack sessions by leveraging knowledge of a session cookie, aka Bug ID CSCuc64885.
[20130410 Multiple Vulnerabilities in Cisco Unified MeetingPlace Solution]
Cisco Unified MeetingPlace Web Conferencing Server 7.x before 7.1MR1 Patch 2, 8.0 before 8.0MR1 Patch 2, and 8.5 before 8.5MR3 Patch 1, when the Remember Me option is used, does not properly verify cookies, which allows remote attackers to impersonate users via a crafted login request, aka Bug ID CSCuc64846.
[20130410 Multiple Vulnerabilities in Cisco Unified MeetingPlace Solution]
The Cisco Prime Network Control System (NCS) appliance with software before 1.1.1.24 has a default password for the database user account, which makes it easier for remote attackers to change the configuration or cause a denial of service (service disruption) via unspecified vectors, aka Bug ID CSCtz30468.
[20130410 Cisco Prime Network Control Systems Database Default Credentials Vulnerability]
Multiple cross-site scripting (XSS) vulnerabilities in the element-list implementation in Cisco Connected Grid Network Management System (CG-NMS) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug IDs CSCue14517, CSCue38914, CSCue38884, CSCue38882, CSCue38881, CSCue38872, CSCue38868, CSCue38866, CSCue38853, and CSCue14540.
[20130401 Cisco Connected Grid Network Management System Cross-Site Scripting Vulnerabilities]
The Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) does not properly verify files, which allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14153.
[20130410 Cisco AnyConnect Security Service File Verification Privilege Elevation Vulnerability]
Heap-based buffer overflow in ciscod.exe in the Cisco Security Service in Cisco AnyConnect Secure Mobility Client (aka AnyConnect VPN Client) allows local users to gain privileges via unspecified vectors, aka Bug ID CSCud14143.
[20130410 Cisco AnyConnect ciscod.exe Heap Overflow Vulnerability]
Cisco Tivoli Business Service Manager (TBSM) in Hosted Collaboration Mediation (HCM) in Cisco Hosted Collaboration Solution allows remote attackers to cause a denial of service (temporary service hang) by sending many TCP packets to certain ports, aka Bug ID CSCue03703.
[20130404 Cisco Tivoli Business Service Manager Denial of Service Vulnerability]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This issue was announced by the vendor and later withdrawn because it was not a vulnerability. Notes: none.
The DSP card on Cisco TelePresence MCU 4500 and 4501 devices before 4.3(2.30), TelePresence MCU MSE 8510 devices before 4.3(2.30), and TelePresence Server before 2.3(1.55) does not properly validate H.264 data, which allows remote attackers to cause a denial of service (device reload) via crafted RTP packets in a (1) SIP session or (2) H.323 session, aka Bug IDs CSCuc11328 and CSCub05448.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130417-tpi
'Vulnerable Products
The following Cisco TelePresence Infrastructure products are affected by this vulnerability:
Cisco TelePresence MCU 4501 Series, MCU 4500 Series and Cisco TelePresence MCU MSE 8510 versions 4.3(2.18) and earlier
Cisco TelePresence Server versions 2.2(1.54) and earlier'
[20130417 Cisco TelePresence Infrastructure Denial of Service Vulnerability]
SQL injection vulnerability in Cisco Network Admission Control (NAC) Manager before 4.8.3.1 and 4.9.x before 4.9.2 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCub23095.
[20130417 Cisco Network Admission Control Manager SQL Injection Vulnerability]
Multiple buffer overflows in the Cisco Discovery Protocol (CDP) implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(4) and 6.x before 6.1(1), Nexus 5000 and 5500 devices 4.x and 5.x before 5.1(3)N1(1), Nexus 4000 devices before 4.1(2)E1(1h), Nexus 3000 devices 5.x before 5.0(3)U3(1), Nexus 1000V devices 4.x before 4.2(1)SV1(5.1), MDS 9000 devices 4.x and 5.x before 5.2(4), Unified Computing System (UCS) 6100 and 6200 devices before 2.0(2m), and Connected Grid Router (CGR) 1000 devices before CG4(1) allow remote attackers to execute arbitrary code via malformed CDP packets, aka Bug IDs CSCtu10630, CSCtu10551, CSCtu10550, CSCtw56581, CSCtu10548, CSCtu10544, and CSCuf61275.
[20130424 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
Multiple buffer overflows in the (1) SNMP and (2) License Manager implementations in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allow remote authenticated users to execute arbitrary code via a crafted SNMP request, aka Bug ID CSCtx54830.
[20130424 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
Buffer overflow in the SNMP implementation in Cisco NX-OS on Nexus 7000 devices 4.x and 5.x before 5.2(5) and 6.x before 6.1(1) and MDS 9000 devices 4.x and 5.x before 5.2(5) allows remote authenticated users to execute arbitrary code via a crafted SNMP request, aka Bug ID CSCtx54822.
[20130424 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
Cisco NX-OS on Nexus 5500 devices 4.x and 5.x before 5.0(3)N2(2), Nexus 3000 devices 5.x before 5.0(3)U3(2), and Unified Computing System (UCS) 6200 devices before 2.0(1w) allows remote attackers to cause a denial of service (device reload) by sending a jumbo packet to the management interface, aka Bug IDs CSCtx17544, CSCts10593, and CSCtx95389.
[20130424 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
The login page in the Web Console in the Manager component in Cisco Unified Computing System (UCS) before 1.0(2h), 1.1 before 1.1(1j), and 1.3(x) allows remote attackers to bypass LDAP authentication via a malformed request, aka Bug ID CSCtc91207.
[20130424 Multiple Vulnerabilities in Cisco Unified Computing System]
Buffer overflow in the Intelligent Platform Management Interface (IPMI) functionality in the Manager component in Cisco Unified Computing System (UCS) 1.0 and 1.1 before 1.1(1j) and 1.2 before 1.2(1b) allows remote attackers to execute arbitrary code via malformed data in a UDP packet, aka Bug ID CSCtd32371.
[20130424 Multiple Vulnerabilities in Cisco Unified Computing System]
The management API in the XML API management service in the Manager component in Cisco Unified Computing System (UCS) 1.x before 1.2(1b) allows remote attackers to cause a denial of service (service outage) via a malformed request, aka Bug ID CSCtg48206.
[20130424 Multiple Vulnerabilities in Cisco Unified Computing System]
The web interface in the Manager component in Cisco Unified Computing System (UCS) 1.x and 2.x before 2.0(2m) allows remote attackers to obtain sensitive information by reading a (1) technical-support bundle file or (2) on-device configuration backup, aka Bug ID CSCtq86543.
[20130424 Multiple Vulnerabilities in Cisco Unified Computing System]
Cisco Unified Computing System (UCS) 1.x before 1.4(4) and 2.x before 2.0(2m) allows remote attackers to bypass KVM authentication via a crafted authentication request to a Cisco Integrated Management Controller (IMC), aka Bug ID CSCts53746.
[20130424 Multiple Vulnerabilities in Cisco Unified Computing System]
The Connection Manager in Cisco Jabber Extensible Communications Platform (aka Jabber XCP) does not properly validate login data, which allows remote attackers to cause a denial of service (service crash) by sending a series of malformed login packets, aka Bug ID CSCts76762.
[20130411 Cisco Jabber Extensible Communications Platform Connection Manager Vulnerability]
Cisco Unified Communications Manager (CUCM) does not properly limit the rate of authentication attempts, which allows remote attackers to cause a denial of service (application slowdown) via a series of requests, aka Bug ID CSCud39515.
[20130514 Cisco Unified Communications Manager Authentication Denial of Service]
Cisco Universal Broadband (aka uBR) 10000 series routers, when an IPv4/IPv6 dual-stack modem is used, allow remote attackers to cause a denial of service (routing-engine reload) via unspecified changes to IP address assignments, aka Bug ID CSCue15313.
[20130410 Cisco uBR10000 Series IPv4/IPv6 Dual Stack Vulnerability]
The C-Series Rack Server component 1.4 in Cisco Unified Computing System (UCS) does not properly restrict inbound access to ports, which allows remote attackers to cause a denial of service (Integrated Management Controller reboot or hang) via crafted packets, as demonstrated by nmap, aka Bug ID CSCtx19850.
[20130731 Cisco Integrated Management Controller Denial of Service Vulnerability]
Cisco NX-OS 6.1 before 6.1(5) on Nexus 7000 devices, when local authentication and multiple VDCs are enabled, allows remote authenticated users to gain privileges within an unintended VDC via crafted SSH key data in an SSH session to a management interface, aka Bug ID CSCud88400.
[20140521 Multiple Vulnerabilities in Cisco NX-OS-Based Products]
The JAR files on Cisco Device Manager for Cisco MDS 9000 devices before 5.2.8, and Cisco Device Manager for Cisco Nexus 5000 devices, allow remote attackers to execute arbitrary commands on Windows client machines via a crafted element-manager.jnlp file, aka Bug IDs CSCty17417 and CSCty10802.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130424-fmdm
"Cisco Device Manager versions 5.x and earlier. Note: Only Cisco Device Manager software installed or launched via JNLP file on Microsoft Windows is affected by this vulnerability."
[20130424 Cisco Device Manager Command Execution Vulnerability]
The Secure Shell (SSH) implementation on Cisco Adaptive Security Appliances (ASA) devices, and in Cisco Firewall Services Module (FWSM), does not properly terminate sessions, which allows remote attackers to cause a denial of service (SSH service outage) by repeatedly establishing SSH connections, aka Bug IDs CSCue63881, CSCuf51892, CSCue78671, and CSCug26937.
[20130412 Secure Shell Denial of Service Vulnerability]
The ISAKMP implementation on Cisco Adaptive Security Appliances (ASA) devices generates different responses for IKE aggressive-mode messages depending on whether invalid VPN groups are specified, which allows remote attackers to enumerate groups via a series of messages, aka Bug ID CSCue73708.
Per: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1194
'A vulnerability in the Internet Security Association and Key Management Protocol (ISAKMP) implementation in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to enumerate remote access VPN groups configured in a Cisco ASA device.'
[20130418 TWSL2013-004: Group Name Enumeration Vulnerability in Cisco IKE Implementation]
[20130417 Cisco ASA Software VPN Group Enumeration Vulnerability]
The time-based ACL implementation on Cisco Adaptive Security Appliances (ASA) devices, and in Cisco Firewall Services Module (FWSM), does not properly handle periodic statements for the time-range command, which allows remote attackers to bypass intended access restrictions by sending network traffic during denied time periods, aka Bug IDs CSCuf79091 and CSCug45850.
[20130422 Time-Range Object Access List Bypass Vulnerability]
The command-line interface in Cisco Secure Access Control System (ACS), Identity Services Engine Software, Context Directory Agent, Application Networking Manager (ANM), Prime Network Control System, Prime LAN Management Solution (LMS), Prime Collaboration, Unified Provisioning Manager, Network Services Manager, Prime Data Center Network Manager (DCNM), and Quad does not properly validate input, which allows local users to obtain root privileges via unspecified vectors, aka Bug IDs CSCug29384, CSCug13866, CSCug29400, CSCug29406, CSCug29411, CSCug29413, CSCug29416, CSCug29418, CSCug29422, CSCug29425, and CSCug29426, a different issue than CVE-2013-1125.
[20130412 Multiple Cisco Products root Privileges Command Execution Vulnerability]
The XML parser in the server in Cisco Unified Presence (CUP) allows remote authenticated users to cause a denial of service (jabberd daemon crash) via crafted XML content in an XMPP message, aka Bug ID CSCue13912.
[20130415 Cisco Unified Presence XMPP Denial of Service Vulnerability]
Cross-site scripting (XSS) vulnerability in a Flash component in Cisco Unified Computing System (UCS) Central allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCud15430.
[20130425 Cisco Unified Computing System Central Software DOM-based Cross-Site Scripting Vulnerability]
Race condition in the CIFS implementation in the rewriter module in the Clientless SSL VPN component on Cisco Adaptive Security Appliances (ASA) devices allows remote authenticated users to cause a denial of service (device reload) by accessing resources within multiple sessions, aka Bug ID CSCub58996.
[20130417 Cisco ASA Clientless SSL VPN CIFS Denial of Service Vulnerability]
Session fixation vulnerability in Cisco Secure Access Control System (ACS) allows remote attackers to hijack web sessions via unspecified vectors, aka Bug ID CSCud95787.
[20130515 Cisco Secure Access Control System Session Fixation Web Vulnerability]
Cisco ASA CX Context-Aware Security Software allows remote attackers to cause a denial of service (device reload) via crafted TCP packets that appear to have been forwarded by a Cisco Adaptive Security Appliances (ASA) device, aka Bug ID CSCue88386.
[20130617 Cisco ASA CX TCP Traffic Denial of Service Vulnerability]
Memory leak in the SNMP process in Cisco IOS XR allows remote attackers to cause a denial of service (memory consumption or process reload) by sending many port-162 UDP packets, aka Bug ID CSCug80345.
[20130522 Cisco IOS XR Software SNMP Denial of Service Vulnerability]
The Event Center module in Cisco WebEx Meetings Server does not perform request authentication in all intended circumstances, which allows remote attackers to discover host keys and event passwords via crafted URLs, aka Bug ID CSCue62485.
[20130604 Cisco WebEx Meetings Server Information Disclosure Vulnerability]
The encryption functionality in Cisco NX-OS on the Nexus 1000V does not properly handle Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication, which allows remote attackers to intercept or modify network traffic by leveraging certain Layer 2 or Layer 3 access, aka Bug ID CSCud14691.
[20130528 Cisco Nexus 1000V VSM/VEM Communication Encryption Issues]
The encryption functionality in the Virtual Supervisor Module (VSM) to Virtual Ethernet Module (VEM) communication component in Cisco NX-OS on the Nexus 1000V does not properly authenticate VSM/VEM packets, which allows remote attackers to disable packet-level encryption and integrity protection via crafted packets, aka Bug ID CSCud14710.
[20130528 Cisco Nexus 1000V VSM/VEM Communication Encryption Bypass Vulnerability]
Array index error in the Virtual Ethernet Module (VEM) kernel driver for VMware ESXi in Cisco NX-OS on the Nexus 1000V, when STUN debugging is enabled, allows remote attackers to cause a denial of service (ESXi crash and purple screen of death) by sending crafted STUN packets to a VEM, aka Bug ID CSCud14825.
[20130528 Cisco Nexus 1000V ESXi Hypervisor Denial of Service Vulnerability]
Cisco NX-OS on the Nexus 1000V does not properly handle authentication for Virtual Ethernet Module (VEM) to Virtual Supervisor Module (VSM) communication, which allows remote attackers to obtain VEM access via (1) spoofed STUN packets or (2) a crafted VMware ESXi instance, aka Bug ID CSCud14832.
[20130528 Cisco Nexus 1000V Insufficient VSM/VEM Authentication]
The SSL functionality in Cisco NX-OS on the Nexus 1000V does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof servers, and intercept or modify Virtual Supervisor Module (VSM) to VMware vCenter communication, via a crafted certificate, aka Bug ID CSCud14837.
[20130528 Cisco Nexus 1000V VSM to vCenter Communication Man-in-the-Middle Vulnerability]
Cisco NX-OS on the Nexus 1000V does not assign the proper priority to heartbeat messages from a Virtual Ethernet Module (VEM) to a Virtual Supervisor Module (VSM), which allows remote attackers to cause a denial of service (false VEM unavailability report) via a flood of UDP packets, aka Bug ID CSCud14840.
[20130528 Cisco Nexus 1000V VSM/VEM Heartbeat Denial of Service Vulnerability]
The scripts editor in Cisco Unified Contact Center Express (aka Unified CCX) does not properly manage privileges for anonymous logins, which allows remote attackers to read arbitrary scripts by visiting the scripts repository directory, aka Bug ID CSCuf77546.
[20130419 Cisco Unified Contact Center Express Editor Information Disclosure Vulnerability]
The vpnclient program in the Easy VPN component on Cisco Adaptive Security Appliances (ASA) 5505 devices allows local users to gain privileges via unspecified vectors, aka Bug ID CSCuf85295.
[20130424 Cisco ASA Software Easy VPN Privilege Escalation Vulnerability]
Memory leak in the SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (memory consumption and process restart) via crafted SNMP packets, aka Bug ID CSCue31546.
[20130425 Cisco IOS XR Software SNMP Memory Leak Vulnerability]
The generic input/output control implementation in Cisco IOS does not properly manage buffers, which allows remote authenticated users to cause a denial of service (device reload) by sending many SNMP requests at the same time, aka Bug ID CSCub41105.
[20130419 Generic Input/Output SNMP Vulnerability]
Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software modules before 7.1(7)sp1E4 allows remote attackers to cause a denial of service (Analysis Engine process hang or device reload) via fragmented (1) IPv4 or (2) IPv6 packets, aka Bug ID CSCue51272.
[20130717 Multiple Vulnerabilities in Cisco Intrusion Prevention System Software]
SensorApp in Cisco Intrusion Prevention System (IPS) allows local users to cause a denial of service (Regex hardware job failure and application hang) via a (1) initiate signature upgrade, (2) initiate global correlation, (3) show statistics anomaly-detection, or (4) clear database action, aka Bug ID CSCuc74630.
[20130426 Cisco IPS SensorApp Regex Vulnerability]
The CallServer component in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to cause a denial of service (call-acceptance outage) via malformed SIP INVITE messages, aka Bug ID CSCua65148.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to execute arbitrary code via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38384.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components, which allows remote attackers to launch arbitrary custom web applications via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38379.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
The log viewer in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly validate an unspecified parameter, which allows remote attackers to read arbitrary files via a crafted (1) HTTP or (2) HTTPS request, aka Bug ID CSCub38372.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
Directory traversal vulnerability in the Resource Manager in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to overwrite arbitrary files via a crafted (1) HTTP or (2) HTTPS request that triggers incorrect parameter validation, aka Bug ID CSCub38369.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 allows remote attackers to read arbitrary files via a Resource Manager (1) HTTP or (2) HTTPS request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, aka Bug ID CSCub38366.
[20130508 Multiple Vulnerabilities in Cisco Unified Customer Voice Portal Software]
The Ethernet frame-forwarding implementation in Cisco NX-OS on Nexus 7000 devices allows remote attackers to cause a denial of service (forwarding loop and service outage) via a crafted frame, aka Bug ID CSCug47098.
[20130425 Cisco Nexus 7000 Frame Forwarding Loop Denial of Service Vulnerability]
Cross-site scripting (XSS) vulnerability in the web framework in Cisco Unified Communications Domain Manager allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka Bug ID CSCug37902.
[20130427 Cisco Unified Communications Domain Manager Cross-Site Scripting Vulnerability]
Cisco Jabber on Windows does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify the client-server data stream via a crafted certificate, aka Bug ID CSCug30280.
[20130905 Cisco Jabber for Windows Certificate Validation Vulnerability]
TMSSNMPService.exe in TelePresence Manager in Cisco TelePresence Management Suite (TMS) on 64-bit platforms allows remote attackers to cause a denial of service (process crash) via SNMP traps, aka Bug ID CSCue00028.
[20130429 Cisco TelePresence Management Suite SNMP Denial of Service Vulnerability]
Cisco Unified Communications Domain Manager allows remote attackers to cause a denial of service (CPU consumption) via a flood of malformed UDP packets, aka Bug ID CSCug47057.
[20130430 Cisco Unified Communications Domain Manager High CPU Utilization Vulnerability]
The HTTP implementation in Cisco WebEx Node for MCS and WebEx Meetings Server allows remote attackers to read cache files via a crafted request, aka Bug IDs CSCue36664 and CSCue36629.
[20130502 Cisco WebEx Cache Directory Read Vulnerability]
The HTTP implementation in Cisco WebEx Node for MCS, WebEx Meetings Server, and WebEx Node for ASR 1000 Series allows remote attackers to read the contents of uninitialized memory locations via a crafted request, aka Bug IDs CSCue36672, CSCue31363, CSCuf17466, and CSCug61252.
[20130503 Cisco WebEx Uninitialized Memory Read Vulnerability]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
The SNMP module in Cisco IOS XR allows remote authenticated users to cause a denial of service (process restart) via crafted SNMP packets, aka Bug ID CSCue69472.
[20130430 Cisco IOS XR Software Crafted SNMP Packets Denial of Service Vulnerability]
Cisco Wireless LAN Controller (WLC) devices do not properly address the resource consumption of terminated TELNET sessions, which allows remote attackers to cause a denial of service (TELNET outage) by making many TELNET connections and improperly ending these connections, aka Bug ID CSCug35507.
[20130503 Cisco Wireless Lan Controller Telnet Denial of Service Vulnerability]
Cisco TelePresence Supervisor MSE 8050 before 2.3(1.31) allows remote attackers to cause a denial of service (CPU consumption or device reload) by establishing TCP connections at a high rate, aka Bug IDs CSCuf76076 and CSCuf79763.
[20130515 Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability]
The command-line interface in Cisco Unified Communications Manager (CUCM) does not properly validate input, which allows local users to read arbitrary files via unspecified vectors, aka Bug ID CSCue25770.
[20130503 Cisco Unified Communications Manager Arbitrary File Read Vulnerability]
The ISM module in Cisco IOS on ISR G2 routers does not properly handle authentication-header packets, which allows remote authenticated users to cause a denial of service (module reload) via a series of malformed packets, aka Bug ID CSCub92025.
[20130506 Cisco ISM Malformed Authentication Header Packet Denial of Service Vulnerability]
Memory leak in the web framework in the server in Cisco Unified Presence (CUP) allows remote attackers to cause a denial of service (memory consumption) via malformed TCP packets, aka Bug ID CSCug38080.
[20130507 Cisco Unified Presence Memory Exhaustion Vulnerability]
The IP stack in Cisco Intrusion Prevention System (IPS) Software in ASA 5500-X IPS-SSP software and hardware modules before 7.1(5)E4, IPS 4500 sensors before 7.1(6)E4, and IPS 4300 sensors before 7.1(5)E4 allows remote attackers to cause a denial of service (MainApp process hang) via malformed IPv4 packets, aka Bug ID CSCtx18596.
[20130717 Multiple Vulnerabilities in Cisco Intrusion Prevention System Software]
Cross-site scripting (XSS) vulnerability in the portal module in Cisco WebEx Social allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL in the link field in a post, aka Bug ID CSCue67199.
[20130514 WebEx Social Allows JavaScript URLs in Links Attached to Posts]
The user-management page in Cisco WebEx Social relies on client-side validation of values in the Screen Name, First Name, Middle Name, Last Name, Email Address, and Job Title fields, which allows remote authenticated users to bypass intended access restrictions via crafted requests, aka Bug ID CSCue67190.
[20130514 WebEx Social Client-Side Restriction Bypass Attribute Change Vulnerability]
Cisco TelePresence System Software does not properly handle inactive t-shell sessions, which allows remote authenticated users to cause a denial of service (memory consumption and service outage) by establishing multiple SSH connections, aka Bug ID CSCug77610.
[20130529 Cisco TelePresence System t-shell Denial of Service Vulnerability]
Cross-site scripting (XSS) vulnerability in the wireless configuration module in Cisco Prime Infrastructure allows remote attackers to inject arbitrary web script or HTML via an SSID that is not properly handled during display of the XML windowing table, aka Bug ID CSCuf04356.
[20130521 Cisco Prime Infrastructure Cross-Site Scripting Vulnerability From Rogue AP SSIDs]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16431]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16320]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16142]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16408]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16480]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16122]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:15524]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16501]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16436]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16176]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16474]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16344]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16301]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16284]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16244]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16342]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16379]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16510]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:15999]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16412]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:15967]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16374]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16349]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16460]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16443]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16490]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16224]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16399]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16432]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges, and consequently read the contents of arbitrary kernel memory locations, via a crafted application, a different vulnerability than other CVEs listed in MS13-016.
[TA13-043B]
[MS13-016]
[oval:org.mitre.oval:def:16256]
Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages incorrect handling of objects in memory, aka "Kernel Race Condition Vulnerability," a different vulnerability than CVE-2013-1279.
[TA13-043B]
[MS13-017]
[oval:org.mitre.oval:def:16313]
Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages incorrect handling of objects in memory, aka "Kernel Race Condition Vulnerability," a different vulnerability than CVE-2013-1278.
[TA13-043B]
[MS13-017]
[oval:org.mitre.oval:def:16458]
The kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Windows Kernel Reference Count Vulnerability."
[TA13-043B]
[MS13-017]
[oval:org.mitre.oval:def:16448]
The NFS server in Microsoft Windows Server 2008 R2 and R2 SP1 and Server 2012 allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via an attempted renaming of a file or folder located on a read-only share, aka "NULL Dereference Vulnerability."
[TA13-043B]
[MS13-014]
[oval:org.mitre.oval:def:16388]
The LDAP service in Microsoft Active Directory, Active Directory Application Mode (ADAM), Active Directory Lightweight Directory Service (AD LDS), and Active Directory Services allows remote attackers to cause a denial of service (memory consumption and service outage) via a crafted query, aka "Memory Consumption Vulnerability."
[TA13-100A]
[MS13-032]
[oval:org.mitre.oval:def:16463]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Race Condition Vulnerability."
[TA13-100A]
[MS13-036]
[oval:org.mitre.oval:def:16563]
Race condition in the kernel in Microsoft Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Kernel Race Condition Vulnerability."
Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-031
"What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could gain elevated privileges and read arbitrary amounts of kernel memory."
[TA13-100A]
[MS13-031]
[oval:org.mitre.oval:def:16455]
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1286 and CVE-2013-1287.
[TA13-071A]
[MS13-027]
[oval:org.mitre.oval:def:16441]
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1287.
[TA13-071A]
[MS13-027]
[oval:org.mitre.oval:def:16591]
The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, and Windows Server 2012 do not properly handle objects in memory, which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device, aka "Windows USB Descriptor Vulnerability," a different vulnerability than CVE-2013-1285 and CVE-2013-1286.
[TA13-071A]
[MS13-027]
[oval:org.mitre.oval:def:16498]
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer CTreeNode Use After Free Vulnerability."
[TA13-071A]
[MS13-021]
[oval:org.mitre.oval:def:16095]
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."
[TA13-100A]
[MS13-035]
[oval:org.mitre.oval:def:16599]
Microsoft SharePoint Server 2013, in certain configurations involving legacy My Sites, does not properly establish default access controls for a SharePoint list, which allows remote authenticated users to bypass intended restrictions on reading list items via a direct request for a list's location, aka "Incorrect Access Rights Information Disclosure Vulnerability."
[TA13-100A]
[MS13-030]
[oval:org.mitre.oval:def:15758]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, Windows 7 Gold and SP1, and Windows 8 allows local users to cause a denial of service (reboot) via a crafted OpenType font, aka "OpenType Font Parsing Vulnerability" or "Win32k Font Parsing Vulnerability."
Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-036
"How could an attacker exploit the vulnerability?
There are multiple means that could allow an attacker to exploit this vulnerability.
In a web-based attack scenario, an attacker could host a specially crafted website that is designed to exploit this vulnerability and then convince a user to view the website. An attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to the attacker's website, or by opening an attachment sent through email.
In a file sharing attack scenario, an attacker could provide a specially crafted document that is designed to exploit this vulnerability, and then convince a user to open the document.
In a local attack scenario, an attacker could also exploit this vulnerability by running a specially crafted application. However, the attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability in this scenario."
[MS13-036]
[oval:org.mitre.oval:def:16504]
Race condition in win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Race Condition Vulnerability."
[TA13-100A]
[MS13-036]
[oval:org.mitre.oval:def:16575]
The NTFS kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) via a crafted application that leverages improper handling of objects in memory, aka "NTFS NULL Pointer Dereference Vulnerability."
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[MS13-036]
[oval:org.mitre.oval:def:16485]
Race condition in the kernel in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Kernel Race Condition Vulnerability."
Per: http://technet.microsoft.com/en-us/security/bulletin/ms13-031
"What might an attacker use the vulnerability to do?
An attacker who successfully exploited this vulnerability could gain elevated privileges and read arbitrary amounts of kernel memory."
[TA13-100A]
[MS13-031]
[oval:org.mitre.oval:def:16257]
The Client/Server Run-time Subsystem (CSRSS) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "CSRSS Memory Corruption Vulnerability."
[TA13-100A]
[MS13-033]
[oval:org.mitre.oval:def:16260]
The Remote Desktop ActiveX control in mstscax.dll in Microsoft Remote Desktop Connection Client 6.1 and 7.0 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code via a web page that triggers access to a deleted object, and allows remote RDP servers to execute arbitrary code via unspecified vectors that trigger access to a deleted object, aka "RDP ActiveX Control Remote Code Execution Vulnerability."
[TA13-100A]
[MS13-029]
[oval:org.mitre.oval:def:16598]
Microsoft Internet Explorer 6 through 8 does not properly restrict data access by VBScript, which allows remote attackers to perform cross-domain reading of JSON files via a crafted web site, aka "JSON Array Information Disclosure Vulnerability."
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16518]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Microsoft Windows Modern Mail allows remote attackers to spoof link targets via a crafted HTML e-mail message.
[2832006]
[http://technet.microsoft.com/security/advisory/2819682]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Memory Allocation Vulnerability."
[33213]
[TA13-190A]
[MS13-053]
[oval:org.mitre.oval:def:17353]
Microsoft Visio 2003 SP3 2007 SP3, and 2010 SP1 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, aka "XML External Entities Resolution Vulnerability."
[TA13-134A]
[MS13-044]
[oval:org.mitre.oval:def:16750]
Microsoft Communicator 2007 R2, Lync 2010, Lync 2010 Attendee, and Lync Server 2013 do not properly handle objects in memory, which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object, aka "Lync RCE Vulnerability."
[TA13-134A]
[MS13-041]
[oval:org.mitre.oval:def:15952]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1304 and CVE-2013-1338.
[TA13-100A]
[MS13-028]
[oval:org.mitre.oval:def:16662]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1303 and CVE-2013-1338.
[TA13-100A]
[MS13-028]
[oval:org.mitre.oval:def:16515]
HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header, aka "HTTP.sys Denial of Service Vulnerability."
[TA13-134A]
[MS13-039]
[oval:org.mitre.oval:def:16088]
Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1313.
[http://blog.skylined.nl/20161208001.html]
[http://packetstormsecurity.com/files/140092/Microsoft-Internet-Explorer-9-MSHTML-CDispNode-InsertSiblingNode-Use-After-Free.html]
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16398]
[40894]
Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-0811.
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16650]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1309 and CVE-2013-2551.
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16415]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-2551.
[http://blog.skylined.nl/20161207001.html]
[http://packetstormsecurity.com/files/140094/Microsoft-Internet-Explorer-MSHTML-CDispNode-InsertSiblingNode-Use-After-Free.html]
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16396]
[oval:org.mitre.oval:def:16738]
[40893]
Use-after-free vulnerability in Microsoft Internet Explorer 6 and 7 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16689]
Use-after-free vulnerability in Microsoft Internet Explorer 8 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
[TA13-134A]
[MS13-037]
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability."
[TA13-134A]
[MS13-037]
[oval:org.mitre.oval:def:16328]
Object Linking and Embedding (OLE) Automation in Microsoft Windows XP SP3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted RTF document, aka "OLE Automation Remote Code Execution Vulnerability."
[TA13-043B]
[MS13-020]
[MS13-037]
[oval:org.mitre.oval:def:16385]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Microsoft SharePoint Server 2007 SP3, 2010 SP1 and SP2, and 2013; Office Web Apps 2010; Excel 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Office for Mac 2011; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
[TA13-253A]
[MS13-067]
[MS13-073]
[oval:org.mitre.oval:def:18333]
[oval:org.mitre.oval:def:18543]
[oval:org.mitre.oval:def:18950]
Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Negative Value Allocation Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16584]
Integer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper allocation-size calculation, aka "Publisher Integer Overflow Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16548]
Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an invalid pointer, aka "Publisher Corrupt Interface Pointer Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16682]
Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Handling Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16749]
Buffer overflow in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Buffer Overflow Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16776]
Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Return Value Validation Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16525]
Microsoft Publisher 2003 SP3 does not properly check table range data, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Invalid Range Check Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16669]
Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items, which allows remote attackers to execute arbitrary code via a crafted Publisher file, aka "Publisher Incorrect NULL Value Handling Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16733]
Stack-based buffer overflow in Microsoft Office 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Stack Buffer Overwrite Vulnerability."
[TA13-317A]
[MS13-091]
[oval:org.mitre.oval:def:19162]
Heap-based buffer overflow in Microsoft Office 2003 SP3 and 2007 SP3 allows remote attackers to execute arbitrary code via a crafted WordPerfect document (.wpd) file, aka "Word Heap Overwrite Vulnerability."
[TA13-317A]
[MS13-091]
[oval:org.mitre.oval:def:19321]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers an improper memory allocation, aka "Publisher Signed Integer Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16355]
Microsoft Publisher 2003 SP3, 2007 SP3, and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers incorrect pointer handling, aka "Publisher Pointer Handling Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16765]
Integer signedness error in Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers a buffer underflow, aka "Publisher Buffer Underflow Vulnerability."
[TA13-134A]
[MS13-042]
[oval:org.mitre.oval:def:16554]
The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
[TA13-253A]
[MS13-067]
[MS13-105]
[oval:org.mitre.oval:def:19040]
Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data in an Office document, leading to improper memory allocation, aka "Office Buffer Overflow Vulnerability."
[TA13-168A]
[MS13-051]
[oval:org.mitre.oval:def:16713]
[oval:org.mitre.oval:def:16732]
dxgkrnl.sys (aka the DirectX graphics kernel subsystem) in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "DirectX Graphics Kernel Subsystem Double Fetch Vulnerability."
[TA13-134A]
[MS13-046]
[oval:org.mitre.oval:def:16332]
Buffer overflow in win32k.sys in the kernel-mode drivers in Microsoft Windows 7 SP1 allows local users to gain privileges via a crafted application that leverages improper handling of objects in memory, aka "Win32k Buffer Overflow Vulnerability."
[TA13-134A]
[MS13-046]
[oval:org.mitre.oval:def:16769]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Window Handle Vulnerability."
[TA13-134A]
[MS13-046]
[oval:org.mitre.oval:def:16091]
Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code via crafted shape data in a Word document, aka "Word Shape Corruption Vulnerability."
[TA13-134A]
[MS13-043]
[oval:org.mitre.oval:def:16229]
The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly check signatures, which allows remote attackers to make undetected changes to signed XML documents via unspecified vectors that preserve signature validity, aka "XML Digital Signature Spoofing Vulnerability."
[TA13-134A]
[MS13-040]
[oval:org.mitre.oval:def:16559]
Microsoft .NET Framework 4.5 does not properly create policy requirements for custom Windows Communication Foundation (WCF) endpoint authentication in certain situations involving passwords over HTTPS, which allows remote attackers to bypass authentication by sending queries to an endpoint, aka "Authentication Bypass Vulnerability."
[TA13-134A]
[MS13-040]
[oval:org.mitre.oval:def:16741]
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1303 and CVE-2013-1304.
[TA13-100A]
[MS13-028]
[oval:org.mitre.oval:def:16621]
The Print Spooler in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly manage memory during deletion of printer connections, which allows remote authenticated users to execute arbitrary code via a crafted request, aka "Print Spooler Vulnerability."
[TA13-168A]
[MS13-050]
[oval:org.mitre.oval:def:16837]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Dereference Vulnerability."
[TA13-190A]
[MS13-053]
[oval:org.mitre.oval:def:17273]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Windows 8 allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability."
[TA13-253A]
[MS13-076]
[oval:org.mitre.oval:def:18660]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1343, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
[TA13-253A]
[MS13-076]
[oval:org.mitre.oval:def:18714]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1344, CVE-2013-3864, and CVE-2013-3865.
[TA13-253A]
[MS13-076]
[oval:org.mitre.oval:def:18551]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows local users to gain privileges via a crafted application, aka "Win32k Multiple Fetch Vulnerability," a different vulnerability than CVE-2013-1342, CVE-2013-1343, CVE-2013-3864, and CVE-2013-3865.
[TA13-253A]
[MS13-076]
[oval:org.mitre.oval:def:18792]
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle objects in memory, which allows local users to gain privileges via a crafted application, aka "Win32k Vulnerability."
[TA13-190A]
[MS13-053]
[oval:org.mitre.oval:def:17379]
mpengine.dll in Microsoft Malware Protection Engine before 1.1.9506.0 on x64 platforms allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted file.
[http://technet.microsoft.com/security/advisory/2846338]
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
[http://technet.microsoft.com/security/advisory/2847140]
[25294]
[TA13-134A]
[MS13-038]
[oval:org.mitre.oval:def:16727]
The Yaml::parse function in Symfony 2.0.x before 2.0.22 remote attackers to execute arbitrary PHP code via a PHP file, a different vulnerability than CVE-2013-1397.
[http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released]
[57574]
[symfony-php-files-code-execution(81550)]
Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
[http://karmainsecurity.com/KIS-2013-10]
[http://sourceforge.net/p/opensis-ce/bugs/59/]
[http://sourceforge.net/p/opensis-ce/code/1009]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate subsequently withdrew it. Notes: none.
Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Lenovo Bluetooth.
Per: http://cwe.mitre.org/data/definitions/426.html
"CWE-426: Untrusted Search Path"
[http://technet.microsoft.com/en-us/security/msvr/msvr13-001]
[57504]
[lenovo-bluetooth-code-exec(81428)]
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
[openSUSE-SU-2013:0621]
[openSUSE-SU-2013:0624]
[20130221 OSEC-2013-01: nagios metacharacter filtering omission]
[24955]
[http://www.occamsec.com/vulnerabilities.html#nagios_metacharacter_vulnerability]
[https://bugzilla.novell.com/show_bug.cgi?id=807241]
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.
[GLSA-201311-15]
[57471]
[http://www.zabbix.com/rn1.8.16.php]
[http://www.zabbix.com/rn2.0.5rc1.php]
[https://support.zabbix.com/browse/ZBX-6097]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1369, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1370, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1372, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[SUSE-SU-2013:0458]
[openSUSE-SU-2013:0459]
[openSUSE-SU-2013:0464]
[HPSBMU02948]
[RHSA-2013:0643]
[http://www.adobe.com/support/security/bulletins/apsb13-09.html]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, and CVE-2013-1373.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Buffer overflow in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0642, CVE-2013-0645, CVE-2013-1365, CVE-2013-1366, CVE-2013-1367, CVE-2013-1368, CVE-2013-1369, CVE-2013-1370, and CVE-2013-1372.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows, before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X, before 10.3.183.61 and 11.x before 11.2.202.270 on Linux, before 11.1.111.43 on Android 2.x and 3.x, and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0644 and CVE-2013-0649.
[openSUSE-SU-2013:0295]
[SUSE-SU-2013:0296]
[openSUSE-SU-2013:0298]
[RHSA-2013:0254]
[http://www.adobe.com/support/security/bulletins/apsb13-05.html]
[TA13-043A]
Heap-based buffer overflow in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X, before 10.3.183.68 and 11.x before 11.2.202.275 on Linux, before 11.1.111.44 on Android 2.x and 3.x, and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.
[SUSE-SU-2013:0458]
[openSUSE-SU-2013:0459]
[openSUSE-SU-2013:0464]
[HPSBMU02948]
[RHSA-2013:0643]
[http://www.adobe.com/support/security/bulletins/apsb13-09.html]
Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0606, CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
[http://www.adobe.com/support/security/bulletins/apsb13-02.html]
Adobe Digital Editions 2.x before 2.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-20.html]
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1380.
[SUSE-SU-2013:0670]
[openSUSE-SU-2013:0675]
[openSUSE-SU-2013:0672]
[HPSBMU02948]
[RHSA-2013:0730]
[http://www.adobe.com/support/security/bulletins/apsb13-11.html]
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 do not properly initialize pointer arrays, which allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[SUSE-SU-2013:0670]
[openSUSE-SU-2013:0675]
[openSUSE-SU-2013:0672]
[HPSBMU02948]
[RHSA-2013:0730]
[http://www.adobe.com/support/security/bulletins/apsb13-11.html]
Adobe Flash Player before 10.3.183.75 and 11.x before 11.7.700.169 on Windows and Mac OS X, before 10.3.183.75 and 11.x before 11.2.202.280 on Linux, before 11.1.111.50 on Android 2.x and 3.x, and before 11.1.115.54 on Android 4.x; Adobe AIR before 3.7.0.1530; and Adobe AIR SDK & Compiler before 3.7.0.1530 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1378.
[SUSE-SU-2013:0670]
[openSUSE-SU-2013:0675]
[openSUSE-SU-2013:0672]
[HPSBMU02948]
[RHSA-2013:0730]
[http://www.adobe.com/support/security/bulletins/apsb13-11.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Buffer overflow in Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-12.html]
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1386.
[http://www.adobe.com/support/security/bulletins/apsb13-12.html]
Adobe Shockwave Player before 12.0.2.122 does not prevent access to address information, which makes it easier for attackers to bypass the ASLR protection mechanism via unspecified vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-12.html]
Adobe Shockwave Player before 12.0.2.122 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2013-1384.
[http://www.adobe.com/support/security/bulletins/apsb13-12.html]
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to impersonate users via unknown vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-10.html]
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 10, 9.0.1 before Update 9, 9.0.2 before Update 4, and 10 before Update 9 allows attackers to obtain administrator-console access via unknown vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-10.html]
Unspecified vulnerability in Adobe ColdFusion 9.0 before Update 11, 9.0.1 before Update 10, 9.0.2 before Update 5, and 10 before Update 10 allows remote attackers to execute arbitrary code via unknown vectors.
[http://www.adobe.com/support/security/bulletins/apsb13-13.html]
Cross-site scripting (XSS) vulnerability in the CurvyCorners module 6.x-1.x and 7.x-1.x for Drupal allows remote authenticated users with the "administer curvycorners" permission to inject arbitrary web script or HTML via unspecified vectors.
[http://packetstormsecurity.com/files/119766/Drupal-CurvyCorners-6.x-7.x-Cross-Site-Scripting.html]
[http://packetstormsecurity.com/files/119814/CurvyCorners-Cross-Site-Scripting.html]
[20130123 [Security-news] SA-CONTRIB-2013-008 - CurvyCorners - Cross Site Scripting (XSS) - module unsupported]
[20130123 CVE-2013-1393]
[http://www.csnc.ch/misc/files/advisories/CVE-2013-1393.txt]
[57526]
[https://drupal.org/node/1896718]
[drupal-curvycorners-unspecified-xss(81499)]
Symfony 2.0.x before 2.0.22, 2.1.x before 2.1.7, and 2.2.x remote attackers to execute arbitrary PHP code via a serialized PHP object to the (1) Yaml::parse or (2) Yaml\Parser::parse function, a different vulnerability than CVE-2013-1348.
[http://symfony.com/blog/security-release-symfony-2-0-22-and-2-1-7-released]
[57574]
[symfony-php-objects-code-execution(81551)]
The pe_mcollective module in Puppet Enterprise (PE) before 2.7.1 does not properly restrict access to a catalog of private SSL keys, which allows remote authenticated users to obtain sensitive information and gain privileges by leveraging root access to a node, related to the master role.
[http://puppetlabs.com/security/cve/cve-2013-1398]
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) node request management, (2) live management, and (3) user administration components in the console in Puppet Enterprise (PE) before 2.7.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
[https://puppetlabs.com/security/cve/cve-2013-1399]
DigiLIBE 3.4 and possibly other versions sends a redirect but does not exit, which allows remote attackers to obtain sensitive configuration information via a direct request to configuration/general_configuration.html.
[20130122 CVE-2013-1402 - DigiLIBE Management Console - Execution After Redirect (EAR) Vulnerability]
VMware vCenter Server 4.0 before Update 4b and 4.1 before Update 3a, VMware VirtualCenter 2.5, VMware vSphere Client 4.0 before Update 4b and 4.1 before Update 3a, VMware VI-Client 2.5, VMware ESXi 3.5 through 4.1, and VMware ESX 3.5 through 4.1 do not properly implement the management authentication protocol, which allow remote servers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.
[http://www.vmware.com/security/advisories/VMSA-2013-0001.html]
The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
[http://www.vmware.com/security/advisories/VMSA-2013-0002.html]
[oval:org.mitre.oval:def:17164]
Multiple cross-site scripting (XSS) vulnerabilities in the Events Manager plugin before 5.3.5 and Events Manager Pro plugin before 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) scope parameter to index.php; (2) user_name, (3) dbem_phone, (4) user_email, or (5) booking_comment parameter to an event with registration enabled; or the (6) _wpnonce parameter to wp-admin/edit.php.
[20130306 Multiple XSS vulnerabilities in Events Manager WordPress plugin]
[http://wp-events-plugin.com/blog/2013/01/22/5-3-5-released-includes-a-security-update]
[https://www.htbridge.com/advisory/HTB23139]
Multiple SQL injection vulnerabilities in the Wysija Newsletters plugin before 2.2.1 for WordPress allow remote authenticated administrators to execute arbitrary SQL commands via the (1) search or (2) orderby parameter to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands.
[20130206 SQL Injection Vulnerability in Wysija Newsletters WordPress Plugin]
[http://packetstormsecurity.com/files/120089/WordPress-Wysija-Newsletters-2.2-SQL-Injection.html]
[57775]
[wp-wysijanewsletters-admin-sql-injection(81932)]
[https://www.htbridge.com/advisory/HTB23140]
Cross-site scripting (XSS) vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the _ajax_nonce parameter to wp-admin/admin-ajax.php.
[20130206 Cross-Site Scripting (XSS) Vulnerability in CommentLuv WordPress Plugin]
[http://packetstormsecurity.com/files/120090/WordPress-CommentLuv-2.92.3-Cross-Site-Scripting.html]
[http://wordpress.org/plugins/commentluv/changelog]
[https://www.htbridge.com/advisory/HTB23138]
DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
[20130128 [KIS-2013-01] DataLife Engine 9.7 (preview.php) PHP Code Injection Vulnerability]
[http://dleviet.com/dle/bug-fix/3281-security-patches-for-dle-97.html]
[http://karmainsecurity.com/KIS-2013-01]
[24438]
[24444]
[57603]
Multiple cross-site scripting (XSS) vulnerabilities in synetics i-doit open 0.9.9-7, i-doit pro 1.0 and earlier, and i-doit pro 1.0.2 when the 'sanitize user input' flag is not enabled, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[20130301 CVE-2013-1413]
[http://www.csnc.ch/en/modules/news/news_0076.html_533560828.html]
Multiple cross-site request forgery (CSRF) vulnerabilities in Fortinet FortiOS on FortiGate firewall devices before 4.3.13 and 5.x before 5.0.2 allow remote attackers to hijack the authentication of administrators for requests that modify (1) settings or (2) policies, or (3) restart the device via a rebootme action to system/maintenance/shutdown.
[26528]
The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[http://krbdev.mit.edu/rt/Ticket/Display.html?id=7570]
[http://krbdev.mit.edu/rt/Ticket/Display.html?id=7577]
[openSUSE-SU-2013:0523]
[http://web.mit.edu/kerberos/www/krb5-1.10/]
[http://web.mit.edu/kerberos/www/krb5-1.11/]
[MDVSA-2013:157]
[https://github.com/krb5/krb5/commit/f249555301940c6df3a2cdda13b56b5674eebc2e]
The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.
[http://krbdev.mit.edu/rt/Ticket/Display.html?id=7600]
[FEDORA-2013-5280]
[FEDORA-2013-5286]
[openSUSE-SU-2013:0746]
[openSUSE-SU-2013:0904]
[openSUSE-SU-2013:0967]
[RHSA-2013:0748]
[MDVSA-2013:157]
[MDVSA-2013:158]
[https://github.com/krb5/krb5/commit/8ee70ec63931d1e38567905387ab9b1d45734d81]
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.
[openSUSE-SU-2013:1833]
[http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt]
[https://bugzilla.redhat.com/show_bug.cgi?id=1030743]
[https://github.com/krb5/krb5/commit/4c023ba43c16396f0d199e2df1cfa59b88b62acc]
The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
CWE-476: NULL Pointer Dereference per http://cwe.mitre.org/data/definitions/476.html
[http://advisories.mageia.org/MGASA-2013-0335.html]
[http://krbdev.mit.edu/rt/Ticket/Display.html?id=7757]
[openSUSE-SU-2013:1738]
[openSUSE-SU-2013:1751]
[openSUSE-SU-2013:1833]
[http://web.mit.edu/kerberos/krb5-1.10/README-1.10.7.txt]
[http://web.mit.edu/kerberos/krb5-1.11/README-1.11.4.txt]
[63555]
[https://bugzilla.redhat.com/show_bug.cgi?id=1026942]
[https://github.com/krb5/krb5/commit/c2ccf4197f697c4ff143b8a786acdd875e70a89d]
[[debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update]
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.
[http://securitymaverick.com/vulnerability-cve-2013-1421-webcalendar-1-2-5-1-2-6-category-name-persistent-xss/]
[http://sourceforge.net/projects/webcalendar/files/webcalendar%201.2/1.2.7/]
(1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8) plugins/scmcvs/common/CVSPlugin.class.php, (9) plugins/scmcvs/cronjobs/cvs.php, (10) plugins/scmcvs/cronjobs/ssh_create.php, (11) plugins/scmgit/common/GitPlugin.class.php, (12) plugins/scmsvn/common/SVNPlugin.class.php, (13) plugins/wiki/cronjobs/create_groups.php, (14) utils/cvs1/cvscreate.sh, and (15) utils/include.pl in FusionForge 5.0, 5.1, and 5.2 allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a (1) symlink or (2) hard link attack on certain files.
[DSA-2633]
[[oss-security] 20130225 fusionforge CVE-2013-1423 multiple privilege escalations]
[58143]
[https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git;a=commitdiff;h=0cc51b3aca51fa915a35195fdf729bcdb903f2af]
[https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git;a=commitdiff;h=1fc730b97c797e03b89cd37823ab345d35286cf4]
[https://fusionforge.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=fusionforge/fusionforge.git;a=commitdiff;h=9937b9d94ab60ff67fe249c1b9a6c8e3fc1778ba]
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.
[DSA-2649]
[58528]
[lighttpd-cve20131427-symlink(82897)]
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
[http://freecode.com/projects/tinc/releases/354122]
[FEDORA-2013-7128]
[FEDORA-2013-7120]
[FEDORA-2013-7085]
[DSA-2663]
[59369]
[http://www.tinc-vpn.org/news/]
[[tinc] 20130422 [Announcement] Tinc version 1.0.21 and 1.1pre7 released]
[https://github.com/gsliepen/tinc/commit/17a33dfd95b1a29e90db76414eb9622df9632320]
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.
[94958]
[https://github.com/neutrinolabs/xrdp/pull/497]
[https://security-tracker.debian.org/tracker/CVE-2013-1430]
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.
[[oss-security] 20130530 CVE-2013-1431: telepathy-gabble: TLS bypass via use of legacy Jabber]
[DSA-2702]
[USN-1873-1]
[https://bugs.freedesktop.org/show_bug.cgi?id=65036]
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.
[SUSE-SU-2014:0446]
[GLSA-201309-24]
[http://support.citrix.com/article/CTX138134]
[DSA-3006]
[[oss-security] 20130626 Xen Security Advisory 58 (CVE-2013-1432) - Page reference counting error due to XSA-45/CVE-2013-1918 fixes]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
[http://forums.cacti.net/viewtopic.php?f=21&t=50593]
[openSUSE-SU-2013:1377]
[http://svn.cacti.net/viewvc?view=rev&revision=7394]
[[oss-security] 20130807 Re: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b]
[61657]
[1028893]
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.
[http://forums.cacti.net/viewtopic.php?f=21&t=50593]
[openSUSE-SU-2013:1377]
[http://svn.cacti.net/viewvc?view=rev&revision=7392]
[http://svn.cacti.net/viewvc?view=rev&revision=7393]
[[oss-security] 20130807 Re: CVE request: SQL injection and shell escaping issues in Cacti < 0.8.8b]
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.
[http://handra.rampa.sk/dawb/patch?repoPURL=http%3A%2F%2Fcode.haskell.org%2FXMonadContrib&repoPHash=20130708144813-1499c-0c3e284d3523c0694b9423714081761813bc1e89]
[GLSA-201405-28]
[[oss-security] 20130726 CVE-2013-1436: xmonad-contrib remote command injection]
[61491]
Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.
[DSA-2748]
[[oss-security] 20130829 [notification] libraw: multiple denial of service vulnerabilities]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[62060]
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.
[DSA-2748]
[[oss-security] 20130829 [notification] libraw: multiple denial of service vulnerabilities]
[https://github.com/LibRaw/LibRaw/commit/11909cc59e712e09b508dda729b99aeaac2b29ad]
econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.
[http://anonscm.debian.org/gitweb/?p=collab-maint/exactimage.git;a=commitdiff;h=1dff2eb586a3d10d8528a984bc471292e3789f5c;hp=acfe54193b18b46e880f4b474d2e40b4fdb44a8d]
[DSA-2754]
[[oss-security] 20130805 [notification] exactimage DoS, jumping into the unknown]
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.
[SUSE-SU-2014:0446]
[openSUSE-SU-2013:1636]
[GLSA-201407-03]
[DSA-3006]
[[oss-security] 20130925 Xen Security Advisory 62 (CVE-2013-1442) - Information leak on AVX and/or LWP capable CPUs]
[1029090]
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.
[openSUSE-SU-2013:1541]
[openSUSE-SU-2013:1685]
[[django-developers] 20130914 Set a reasonable upper bound on password length]
[DSA-2758]
[https://www.djangoproject.com/weblog/2013/sep/15/security/]
A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=724614]
[[oss-security] 20130925 [notification] txt2man unsafe use of tempoarary files]
[USN-1979-1]
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.
[DSA-2781]
[[oss-security] 20131017 CVE-2013-1445 python-crypto:PRNG not correctly reseeded in some situations]
[https://github.com/dlitz/pycrypto/commit/19dcf7b15d61b7dc1a125a367151de40df6ef175]
OpenJPEG 1.3 and earlier allows remote attackers to cause a denial of service (memory consumption or crash) via unspecified vectors related to NULL pointer dereferences, division-by-zero, and other errors.
[http://openjpeg.googlecode.com/svn/tags/version.1.5.2/NEWS]
[RHSA-2013:1850]
[[oss-security] 20131204 Fwd: [vs] multiple issues in openjpeg]
[DSA-2808]
[64142]
Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not properly reuse TCP sessions to the proxy server, which allows remote attackers to obtain sensitive information intended for a specific host via a crafted HTML document that triggers many HTTPS requests and then triggers an HTTP request to that host, as demonstrated by reading a Cookie header, aka MSRC 12096gd.
[http://pastebin.com/raw.php?i=rz9BcBey]
[http://www.youtube.com/ChristianHaiderPoC]
[http://www.youtube.com/watch?v=TPqagWAvo8U]
Microsoft Internet Explorer 8 and 9, when the Proxy Settings configuration has the same Proxy address and Port values in the HTTP and Secure rows, does not ensure that the SSL lock icon is consistent with the Address bar, which makes it easier for remote attackers to spoof web sites via a crafted HTML document that triggers many HTTPS requests to an arbitrary host, followed by an HTTPS request to a trusted host and then an HTTP request to an untrusted host, a related issue to CVE-2013-1450.
[http://pastebin.com/raw.php?i=rz9BcBey]
[http://www.youtube.com/ChristianHaiderPoC]
[http://www.youtube.com/watch?v=TPqagWAvo8U]
plugins/system/highlight/highlight.php in Joomla! 3.0.x through 3.0.2 and 2.5.x through 2.5.8 allows attackers to unserialize arbitrary PHP objects to obtain sensitive information, delete arbitrary directories, conduct SQL injection attacks, and possibly have other impacts via the highlight parameter. Note: it was originally reported that this issue only allowed attackers to obtain sensitive information, but later analysis demonstrated that other attacks exist.
[http://developer.joomla.org/security/news/548-20130201-core-information-disclosure.html]
[http://karmainsecurity.com/analysis-of-the-joomla-php-object-injection-vulnerability]
[http://karmainsecurity.com/KIS-2013-03]
[joomla-search-information-disclosure(81925)]
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to "Coding errors."
[http://developer.joomla.org/security/news/550-20130203-core-information-disclosure.html]
[joomla-unspec2-info-disclosure(81927)]
Joomla! 3.0.x through 3.0.2 allows attackers to obtain sensitive information via unspecified vectors related to an "Undefined variable."
[http://developer.joomla.org/security/news/549-20130202-core-information-disclosure.html]
[joomla-variable-information-disclosure(81926)]
The ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and service crash) via a SOAPAction header that lacks a # (pound sign) character, a different vulnerability than CVE-2013-0230.
[https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play]
[https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf]
[https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb]
Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a " (double quote) character, a different vulnerability than CVE-2013-0230.
[https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play]
[https://community.rapid7.com/servlet/JiveServlet/download/2150-1-16596/SecurityFlawsUPnP.pdf]
[https://community.rapid7.com/servlet/servlet.FileDownload?file=00P1400000cCaFb]
Cross-site scripting (XSS) vulnerability in js/tabletools/zeroclipboard.swf in the WP-Table Reloaded module before 1.9.4 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this might be the same vulnerability as CVE-2013-1808. If so, it is likely that CVE-2013-1463 will be REJECTed.
[http://packetstormsecurity.com/files/119968/WordPress-WP-Table-Reloaded-Cross-Site-Scripting.html]
[http://tobias.baethge.com/2013/01/maintenance-release-wp-table-reloaded-1-9-4/]
[57664]
[wptablereloaded-zeroclipboard-xss(81748)]
Cross-site scripting (XSS) vulnerability in assets/player.swf in the Audio Player plugin before 2.0.4.6 for Wordpress allows remote attackers to inject arbitrary web script or HTML via the playerID parameter.
[http://insight-labs.org/?p=738]
[http://packetstormsecurity.com/files/120129/WordPress-Audio-Player-SWF-Cross-Site-Scripting.html]
[http://wordpress.org/extend/plugins/audio-player/changelog/]
[57848]
The Cubecart::_basket method in classes/cubecart.class.php in CubeCart 5.0.0 through 5.2.0 allows remote attackers to unserialize arbitrary PHP objects via a crafted shipping parameter, as demonstrated by modifying the application configuration using the Config object.
[20130206 [KIS-2013-02] CubeCart <= 5.2.0 (cubecart.class.php) PHP Object Injection Vulnerability]
[http://forums.cubecart.com/?showtopic=47026]
[http://karmainsecurity.com/KIS-2013-02]
[http://packetstormsecurity.com/files/120094/CubeCart-5.2.0-PHP-Object-Injection.html]
[24465]
[57770]
[cubecart-shipping-unauth-access(81920)]
Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4) calendar_type, (5) city, (6) state, (7) title, (8) url, or (9) zipcode parameter to calendar/index.php; (10) title or (11) url parameter to links/index.php; or (12) PATH_INFO to admin/plugins/mediagallery/xppubwiz.php/.
[20130220 Multiple Cross-Site Scripting (XSS) in glFusion]
[http://packetstormsecurity.com/files/120423/glFusion-1.2.2-Cross-Site-Scripting.html]
[24536]
[http://www.glfusion.org/article.php/glf122_update_20130130_01]
[glfusion-multiple-xss(82211)]
[https://www.htbridge.com/advisory/HTB23142]
Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
[20130227 Multiple Vulnerabilities in Piwigo]
[http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html]
[http://piwigo.org/bugs/view.php?id=0002844]
[http://piwigo.org/forum/viewtopic.php?id=21470]
[http://piwigo.org/releases/2.4.7]
[24561]
[https://www.htbridge.com/advisory/HTB23144]
Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
[20130227 Multiple Vulnerabilities in Piwigo]
[http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html]
[http://piwigo.org/bugs/view.php?id=0002843]
[http://piwigo.org/forum/viewtopic.php?id=21470]
[http://piwigo.org/releases/2.4.7]
[24561]
[http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php]
[https://www.htbridge.com/advisory/HTB23144]
Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendar_type parameter to submit.php.
[20130227 Cross-Site Scripting (XSS) in Geeklog]
[http://packetstormsecurity.com/files/120593/Geeklog-1.8.2-Cross-Site-Scripting.html]
[geeklog-calendartype-xss(82326)]
[https://www.geeklog.net/article.php/geeklog-1.8.2sr1]
[https://www.htbridge.com/advisory/HTB23143]
Multiple cross-site scripting (XSS) vulnerabilities in admin/FEAdmin.html in Fortinet FortiMail before 4.3.4 on FortiMail Identity-Based Encryption (IBE) appliances allow user-assisted remote attackers to inject arbitrary web script or HTML via (1) the Add field for the Black List under Antispam Management User Preferences or (2) the User name field for the Personal Black/White List in the AntiSpam section.
[http://www.fortiguard.com/advisory/FG-IR-013-001.html]
[http://www.vulnerability-lab.com/get_content.php?id=701]
[http://www.youtube.com/watch?v=5d7cIaM80oY]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16620]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect integrity via unknown vectors related to Deployment.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57731]
[TA13-032A]
[oval:org.mitre.oval:def:16074]
[oval:org.mitre.oval:def:19121]
[oval:org.mitre.oval:def:19271]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16378]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "IIOP type reuse management" in ObjectStreamClass.java.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/127e4c348a71]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57694]
[TA13-032A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21631786]
[https://bugzilla.redhat.com/show_bug.cgi?id=860652]
[oval:org.mitre.oval:def:16613]
[oval:org.mitre.oval:def:19238]
[oval:org.mitre.oval:def:19325]
[oval:org.mitre.oval:def:19593]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to CORBA, a different vulnerability than CVE-2013-0441 and CVE-2013-1475. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass Java sandbox restrictions via "certain value handler constructors."
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=907457]
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/corba/rev/5116fe321210]
[openSUSE-SU-2013:0312]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57696]
[TA13-032A]
[oval:org.mitre.oval:def:16652]
[oval:org.mitre.oval:def:19466]
[oval:org.mitre.oval:def:19475]
[oval:org.mitre.oval:def:19507]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16657]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" that can trigger an integer overflow and memory corruption.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client and server deployment of Java. This vulnerability can be exploited through untrusted Java Web Start applications and untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service."
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/d89bd26ac435]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57686]
[TA13-032A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21645566]
[https://bugzilla.redhat.com/show_bug.cgi?id=906894]
[oval:org.mitre.oval:def:15733]
[oval:org.mitre.oval:def:19429]
[oval:org.mitre.oval:def:19454]
[oval:org.mitre.oval:def:19529]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, and JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[RHSA-2013:0237]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57706]
[TA13-032A]
[oval:org.mitre.oval:def:16531]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier, and OpenJDK 6 and 7, allows remote attackers to affect confidentiality, integrity, and availability via vectors related to AWT. NOTE: the previous information is from the February 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "insufficient validation of raster parameters" in awt_parseImage.c, which triggers memory corruption.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client and server deployment of Java. This vulnerability can be exploited through untrusted Java Web Start applications and untrusted Java applets. It can also be exploited by supplying data to APIs in the specified Component without using untrusted Java Web Start applications or untrusted Java applets, such as through a web service."
[http://icedtea.classpath.org/hg/release/icedtea6-1.11/file/icedtea6-1.11.6/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/50e268c1fb1f]
[openSUSE-SU-2013:0377]
[SUSE-SU-2013:0478]
[HPSBUX02857]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:0237]
[RHSA-2013:0245]
[RHSA-2013:0246]
[RHSA-2013:0247]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#858729]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57691]
[TA13-032A]
[https://bugzilla.redhat.com/show_bug.cgi?id=906904]
[oval:org.mitre.oval:def:16045]
[oval:org.mitre.oval:def:18845]
[oval:org.mitre.oval:def:19351]
[oval:org.mitre.oval:def:19504]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0056]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 6 through Update 38, 5.0 through Update 38, and 1.4.2_40 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[SUSE-SU-2013:0478]
[SSRT101156]
[HPSBMU02874]
[RHSA-2013:0236]
[RHSA-2013:1455]
[RHSA-2013:1456]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[57718]
[TA13-032A]
[oval:org.mitre.oval:def:16430]
[oval:org.mitre.oval:def:19170]
[oval:org.mitre.oval:def:19268]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16222]
Unspecified vulnerability in the JavaFX component in Oracle Java SE JavaFX 2.2.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than other CVEs listed in the February 2013 CPU.
[HPSBMU02874]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[TA13-032A]
[oval:org.mitre.oval:def:16276]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
[http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/]
[HPSBUX02857]
[HPSBMU02874]
[GLSA-201406-32]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html]
[USN-1735-1]
[TA13-051A]
[oval:org.mitre.oval:def:19508]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.
Per vendor Note 1 "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/]
[HPSBUX02857]
[HPSBMU02874]
[GLSA-201406-32]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html]
[USN-1735-1]
[TA13-051A]
[oval:org.mitre.oval:def:19388]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
Per vendor Note 1 "Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)"
[http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/]
[SUSE-SU-2013:0328]
[openSUSE-SU-2013:0375]
[openSUSE-SU-2013:0378]
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[MDVSA-2013:095]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html]
[58029]
[USN-1735-1]
[TA13-051A]
[oval:org.mitre.oval:def:19402]
[oval:org.mitre.oval:def:19469]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0084]
Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
Per http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html
'Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)'
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:1455]
[RHSA-2013:1456]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013update-1905892.html]
[58031]
[USN-1735-1]
[TA13-051A]
[oval:org.mitre.oval:def:19511]
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, "improper toString calls," and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/a19614a3dabb]
[SUSE-SU-2013:0814]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[RHSA-2013:0752]
[RHSA-2013:0757]
[GLSA-201406-32]
[MDVSA-2013:145]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[USN-1806-1]
[TA13-107A]
[http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/]
[https://bugzilla.redhat.com/show_bug.cgi?id=920247]
[oval:org.mitre.oval:def:16511]
[https://twitter.com/thezdi/status/309425888188043264]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.
Per: http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html
"This issue (CVE-2013-1489) has been discussed publicly and is sometimes known as the "Java Security Slider vulnerability". It has a CVSS of 0 because it does not directly result in an exploitation, but may be combined with other vulnerabilities to allow blind exploitation. When the Security Slider is set to the default (high) all unsigned applets must be authorized via a dialog box by a browser user in order to execute. This provides the browser operator the opportunity to prevent execution of suspicious applets that may result in successful exploits. However, when CVE-2013-1489 is combined with vulnerabilities that can be used to cause direct impacts, the effect can be that the impact can be caused "silently" without the authorization dialog box."
[http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53]
[HPSBUX02857]
[HPSBMU02874]
[RHSA-2013:0237]
[20130127 [SE-2012-01] An issue with new Java SE 7 security features]
[http://thenextweb.com/insider/2013/01/28/new-vulnerability-bypasses-oracles-attempt-to-stop-malware-drive-by-downloads-via-java-applets/]
[http://www.informationweek.com/security/application-security/java-security-work-remains-bug-hunter-sa/240147150]
[VU#858729]
[http://www.oracle.com/technetwork/topics/security/javacpufeb2013-1841061.html]
[http://www.scmagazine.com.au/News/330453,java-still-unsafe-new-flaws-discovered.aspx]
[TA13-032A]
[http://www.zdnet.com/java-update-doesnt-prevent-silent-exploits-at-all-7000010422/]
[oval:org.mitre.oval:def:15906]
[oval:org.mitre.oval:def:19171]
Unspecified vulnerability in Oracle Java SE 7 Update 11 (JRE 1.7.0_11-b21) allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors, aka "Issue 51," a different vulnerability than CVE-2013-0431. NOTE: as of 20130130, this vulnerability does not contain any independently-verifiable details, and there is no vendor acknowledgement. A CVE identifier is being assigned because this vulnerability has received significant public attention, and the original researcher has an established history of releasing vulnerability reports that have been fixed by vendors. NOTE: this issue also exists in SE 6, but it cannot be exploited without a separate vulnerability.
[http://arstechnica.com/security/2013/01/critical-java-vulnerabilies-confirmed-in-latest-version/]
[http://blogs.computerworld.com/malware-and-vulnerabilities/21693/yet-another-java-security-flaw-discovered-number-53]
[20130118 [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
[20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
[http://www.informationweek.com/security/application-security/java-hacker-uncovers-two-flaws-in-latest/240146717]
[20130122 Re: [SE-2012-01] Java 7 Update 11 confirmed to be vulnerable]
The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.
[SSRT101305]
[http://h30499.www3.hp.com/t5/HP-Security-Research-Blog/Pwn2Own-2013/ba-p/5981157]
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SUSE-SU-2013:0934]
[SSRT101252]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[TA13-107A]
[http://www.zdnet.com/pwn2own-down-go-all-the-browsers-7000012283/]
[oval:org.mitre.oval:def:16663]
[oval:org.mitre.oval:def:19482]
[oval:org.mitre.oval:def:19553]
[https://twitter.com/thezdi/status/309438311112507392]
Buffer overflow in yaSSL, as used in MySQL 5.1.x before 5.1.68 and 5.5.x before 5.5.30, has unspecified impact and attack vectors, a different vulnerability than CVE-2012-0553.
[http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-68.html]
[http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-30.html]
[GLSA-201308-06]
[https://blogs.oracle.com/sunsecurity/entry/cve_2013_1492_buffer_overflow]
The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
[http://blog.fireeye.com/research/2013/02/yaj0-yet-another-java-zero-day-2.html]
[HPSBMU02964]
[openSUSE-SU-2013:0430]
[SUSE-SU-2013:0434]
[openSUSE-SU-2013:0438]
[SUSE-SU-2013:0701]
[[distro-pkg-dev] 20130304 [SECURITY] IcedTea6 1.11.9 and 1.12.4 Released!]
[HPSBUX02857]
[SSRT101156]
[RHSA-2013:0601]
[RHSA-2013:0603]
[RHSA-2013:0604]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[24904]
[VU#688246]
[MDVSA-2013:095]
[http://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/1915099.xml]
[http://www.oracle.com/technetwork/topics/security/alert-cve-2013-1493-1915081.html]
[58238]
[1029803]
[http://www.symantec.com/connect/blogs/latest-java-zero-day-shares-connections-bit9-security-incident]
[USN-1755-2]
[TA13-064A]
[https://bugzilla.redhat.com/show_bug.cgi?id=917553]
[https://krebsonsecurity.com/2013/03/new-java-0-day-attack-echoes-bit9-breach/]
[oval:org.mitre.oval:def:19246]
[oval:org.mitre.oval:def:19477]
[https://twitter.com/jduck1337/status/307629902574800897]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0088]
Unspecified vulnerability in Oracle Sun Solaris 10, when running on SPARC T4 servers, allows local users to affect availability via unknown vectors related to Kernel.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19416]
asr in Oracle Auto Service Request in Oracle Support Tools before 4.3.2 allows local users to modify arbitrary files via a symlink attack on a predictable filename in /tmp.
[20130301 Oracle Auto Service Request /tmp file clobbering vulnerability]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/IO, a different vulnerability than CVE-2013-1498.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19164]
Unspecified vulnerability in the Oracle COREid Access component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to WebGate - WebServer plugin.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Kernel/IO, a different vulnerability than CVE-2013-1496.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19498]
Unspecified vulnerability in Oracle Sun Solaris 11 allows local users to affect availability via unknown vectors related to Network Configuration.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows local users to affect confidentiality and integrity via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to weak permissions for shared memory.
Per: http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
'Applies to client deployment of Java only. This issue cannot be exploited through sandboxed Java Web Start applications and sandboxed Java applets. Local access is required to leverage this issue.'
[http://advisories.mageia.org/MGASA-2013-0185.html]
[http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=975148]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/1111f9acb96b]
[SUSE-SU-2013:1255]
[SUSE-SU-2013:1257]
[SUSE-SU-2013:1263]
[SUSE-SU-2013:1264]
[SUSE-SU-2013:1293]
[SUSE-SU-2013:1305]
[HPSBUX02908]
[RHSA-2013:0963]
[RHSA-2013:1059]
[RHSA-2013:1060]
[RHSA-2013:1081]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[MDVSA-2013:183]
[http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html]
[60627]
[TA13-169A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21642336]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644197]
[RHSA-2014:0414]
[oval:org.mitre.oval:def:17221]
[oval:org.mitre.oval:def:19663]
[oval:org.mitre.oval:def:19726]
[https://twitter.com/timb_machine/status/347110990124568577]
Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect integrity via unknown vectors related to Login.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.5.30 and earlier and 5.6.9 and earlier allows local users to affect availability via unknown vectors related to Server Partition.
[GLSA-201308-06]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect integrity via unknown vectors related to Content Server.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2, 10.3.5, 10.3.6, and 12.1.1 allows remote attackers to affect integrity via unknown vectors related to WebLogic Console, a different vulnerability than CVE-2013-2390.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, 5.5.29 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Locking.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle Sun Solaris 10 and 11 allows local users to affect availability via unknown vectors related to Filesystem.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19438]
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Middleware Products 3.0.1 and 3.1.2 allows remote attackers to affect integrity via vectors related to REST Interface.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.0, and 11.1.1.6.1 allows remote authenticated users to affect integrity via unknown vectors related to WebCenter Sites.
[20130417 SEC Consult SA-20130417-2 :: HTTP header injection/Cache poisoning in Oracle WebCenter Sites Satellite Server]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Portal Framework, a different vulnerability than CVE-2015-0419.
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.5.30 and earlier and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[GLSA-201308-06]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote authenticated users to affect integrity via vectors related to RMI Support.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Middleware Products 3.0.1 and 3.1.2 allows remote attackers to affect integrity via vectors related to ADMIN Interface.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebCenter Capture component in Oracle Fusion Middleware 10.1.3.5.1 allows remote authenticated users to affect availability via unknown vectors related to Import Server.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors related to Diagnostics.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JAXP. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions."
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jaxp/rev/38d4d23d167c]
[SUSE-SU-2013:0814]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[GLSA-201406-32]
[MDVSA-2013:145]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59141]
[USN-1806-1]
[TA13-107A]
[https://bugzilla.redhat.com/show_bug.cgi?id=952646]
[oval:org.mitre.oval:def:16702]
[oval:org.mitre.oval:def:19451]
[oval:org.mitre.oval:def:19705]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.1 allows remote attackers to affect integrity via unknown vectors.
[SUSE-SU-2013:0810]
[SUSE-SU-2013:0811]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Clinical Remote Data Capture Option component in Oracle Industry Applications 4.6.0 and 4.6.6 allows remote authenticated users to affect confidentiality and integrity via vectors related to HTML Surround.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Locking.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote attackers to affect integrity via unknown vectors related to Content Server.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier and 5.6.10 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Optimizer.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 12.0.6 and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Attachments.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Retail Integration Bus component in Oracle Industry Applications 13.0, 13.1, and 13.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Retail Integration Bus Manager.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.5.29 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Replication.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Report Distribution.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle HRMS component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect integrity via unknown vectors related to Payroll.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle WebCenter Interaction component in Oracle Fusion Middleware 6.5.1 and 10.3.3.0 allows remote attackers to affect integrity via unknown vectors related to Image Service.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle Sun Solaris 10 allows local users to affect availability via unknown vectors related to Kernel.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[oval:org.mitre.oval:def:19192]
Unspecified vulnerability in Oracle MySQL 5.1.66 and earlier and 5.5.28 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Server Privileges.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Information Schema.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0, 5.1.0, 5.2.0, 5.3.1 through 5.3.3, and 6.0.1 through 12.0.0 allows remote authenticated users to affect confidentiality and integrity via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Workload Manager component in Oracle Database Server 11.2.0.2 and 11.2.0.3, when used in RAC configurations, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
[SUSE-SU-2013:0810]
[SUSE-SU-2013:0811]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 4.1.0, 5.1.0, 5.2.0, 5.3.4, and 6.0.1 allows remote attackers to affect confidentiality via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.05 and 6.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false, which allows remote attackers to perform "dynamic class downloading" and execute arbitrary code.
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/f098e2297ff1]
[http://icedtea.classpath.org/hg/release/icedtea7-forest-2.3/jdk/rev/096ed306159f]
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0814]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SUSE-SU-2013:0934]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[20130205 Re: [SE-2012-01] Details of issues fixed by Feb 2013 Java SE CPU]
[GLSA-201406-32]
[MDVSA-2013:145]
[MDVSA-2013:150]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/java/javase/7u21-relnotes-1932873.html#rmichanges]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[http://www.security-explorations.com/en/SE-2012-01-details.html]
[59194]
[USN-1806-1]
[TA13-107A]
[https://bugzilla.redhat.com/show_bug.cgi?id=952387]
[oval:org.mitre.oval:def:16578]
[oval:org.mitre.oval:def:19385]
[oval:org.mitre.oval:def:19550]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in the Network Layer component in Oracle Database Server 11.2.0.2 and 11.2.0.3 allows remote attackers to affect availability via unknown vectors.
[SUSE-SU-2013:0810]
[SUSE-SU-2013:0811]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0, 5.0.2 through 5.0.5, and 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality via vectors related to CTF.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect integrity via unknown vectors related to Deployment, a different vulnerability than CVE-2013-2433.
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SSRT101252]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59149]
[TA13-107A]
[oval:org.mitre.oval:def:16333]
[oval:org.mitre.oval:def:19567]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0, 5.0.2 through 5.0.5, and 5.3.0 through 5.3.4 allows remote authenticated users to affect confidentiality via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via unknown vectors related to Servlet Runtime.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Open UI Client.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.68 and earlier, 5.5.30 and earlier, and 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle HTTP Server component in Oracle Fusion Middleware 10.1.3.5, 11.1.1.5.0, and 11.1.1.6.0 allows remote attackers to affect availability via unknown vectors related to Web Listener.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 3.1.0 and 5.0.2 through 12.0.1 allows local users to affect confidentiality via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 12.0.1 allows remote authenticated users to affect integrity via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.63 and earlier allows remote authenticated users to affect availability via unknown vectors related to Server Types.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 5.3.3, 6.0.1, and 12.0.0 allows remote authenticated users to affect integrity via vectors related to BASE.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via unknown vectors related to WorkCenter.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Siebel Enterprise Application Integration component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Integration Business Services.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier and 5.5.29 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle Web Services Manager component in Oracle Fusion Middleware 11.1.1.6.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Services Security.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Network Layer component in Oracle Database Server 10.2.0.4, 10.2.0.5, 11.1.0.7, 11.2.0.2, and 11.2.0.3 allows remote attackers to affect availability via unknown vectors.
[SUSE-SU-2013:0810]
[SUSE-SU-2013:0811]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.1.67 and earlier, and 5.5.29 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Partition.
[RHSA-2013:0772]
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 12.0.1 allows remote authenticated users to affect integrity via vectors related to OTH.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "missing security restrictions" in the LogStream.setDefaultStream method.
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/76eb3fb80740]
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0814]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SUSE-SU-2013:0934]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[MDVSA-2013:145]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59170]
[USN-1806-1]
[TA13-107A]
[IV40772]
[http://www-01.ibm.com/support/docview.wss?uid=swg21645566]
[https://bugzilla.redhat.com/show_bug.cgi?id=952648]
[oval:org.mitre.oval:def:16688]
[oval:org.mitre.oval:def:19294]
[oval:org.mitre.oval:def:19672]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and 6 Update 43 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Beans.
[APPLE-SA-2013-04-16-2]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59219]
[USN-1806-1]
[TA13-107A]
[oval:org.mitre.oval:def:16543]
[oval:org.mitre.oval:def:19158]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 4.1.0 allows remote authenticated users to affect confidentiality via vectors related to BASE, a different vulnerability than CVE-2013-2385.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
[59244]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality via unknown vectors related to JavaFX.
[RHSA-2013:0757]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[TA13-107A]
[oval:org.mitre.oval:def:16481]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 4.1.0 allows remote authenticated users to affect integrity via vectors related to HELP.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install.
1.Applies to client deployment of Java only. This vulnerability can be exploited only through untrusted Java Web Start applications and untrusted Java applets. (Untrusted Java Web Start applications and untrusted applets run in the Java sandbox with limited privileges.)
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SSRT101252]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59208]
[TA13-107A]
[oval:org.mitre.oval:def:19364]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to affect integrity via unknown vectors related to JavaFX.
[RHSA-2013:0757]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[TA13-107A]
[oval:org.mitre.oval:def:16147]
Unspecified vulnerability in the Oracle GoldenGate Veridata component in Oracle Fusion Middleware 3.0.0.11 allows remote attackers to affect availability via unknown vectors.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to InnoDB.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote authenticated users to affect availability via unknown vectors related to Data Manipulation Language, a different vulnerability than CVE-2013-2395.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 2.8.0 through 5.3.3, 6.0.1, and 6.2.0 allows remote authenticated users to affect availability via unknown vectors related to CB.
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.
[http://blog.fuseyism.com/index.php/2013/04/22/security-icedtea-2-3-9-for-openjdk-7-released/]
[http://blog.fuseyism.com/index.php/2013/04/25/security-icedtea-1-11-11-1-12-5-for-openjdk-6-released/]
[http://bugs.icu-project.org/trac/ticket/10107]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/6784c9903db7]
[APPLE-SA-2013-04-16-2]
[SUSE-SU-2013:0814]
[SUSE-SU-2013:0835]
[SUSE-SU-2013:0871]
[SUSE-SU-2013:0934]
[openSUSE-SU-2013:0777]
[openSUSE-SU-2013:0964]
[[distro-pkg-dev] 20130417 [SECURITY] IcedTea 1.11.10 for OpenJDK 6 Released!]
[SSRT101252]
[RHSA-2013:0752]
[RHSA-2013:0757]
[RHSA-2013:0758]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[http://site.icu-project.org/download/51#TOC-Known-Issues]
[MDVSA-2013:145]
[MDVSA-2013:161]
[http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html]
[http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html]
[http://www.oracle.com/technetwork/topics/security/javacpuapr2013-1928497.html]
[59166]
[USN-1806-1]
[TA13-107A]
[https://bugzilla.redhat.com/show_bug.cgi?id=952711]
[oval:org.mitre.oval:def:16697]
[oval:org.mitre.oval:def:19327]
[oval:org.mitre.oval:def:19556]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0124]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0130]
Unspecified vulnerability in Oracle MySQL 5.6.10 and earlier allows remote attackers to affect availability via unknown vectors related to MemCached.
[GLSA-201308-06]
[MDVSA-2013:150]
[http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html]
Unspecified vulnerability in the Javadoc component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier; JavaFX 2.2.21 and earlier; and OpenJDK 7 allows remote attackers to affect integrity via unknown vectors related to Javadoc. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to frame injection in HTML that is generated by Javadoc.
Per: http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html
'Applies to the Javadoc tool and documentation generated by the tool. This vulnerability can be exploited only through Javadoc output hosted on a web server. This addresses CERT/CC VU#225657.'
[http://advisories.mageia.org/MGASA-2013-0185.html]
[SSRT101305]
[http://hg.openjdk.java.net/jdk7u/jdk7u-dev/langtools/rev/17ee569d0c01]
[SUSE-SU-2013:1255]
[SUSE-SU-2013:1257]
[SUSE-SU-2013:1263]
[SUSE-SU-2013:1293]
[SUSE-SU-2013:1305]
[HPSBUX02907]
[HPSBUX02908]
[RHSA-2013:0963]
[RHSA-2013:1059]
[RHSA-2013:1060]
[RHSA-2013:1081]
[RHSA-2013:1455]
[RHSA-2013:1456]
[GLSA-201406-32]
[VU#225657]
[MDVSA-2013:183]
[http://www.oracle.com/technetwork/topics/security/javacpujun2013-1899847.html]
[60634]
[TA13-169A]
[http://www-01.ibm.com/support/docview.wss?uid=swg21642336]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644197]
[RHSA-2014:0414]
[https://bugzilla.redhat.com/show_bug.cgi?id=973474]
[[tomcat-dev] 20190413 svn commit: r1857494 [15/20] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[[tomcat-dev] 20190325 svn commit: r1856174 [21/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/]
[[tomcat-dev] 20190415 svn commit: r1857582 [16/22] - in /tomcat/site/trunk: docs/ xdocs/stylesheets/]
[[tomcat-dev] 20190319 svn commit: r1855831 [23/30] - in /tomcat/site/trunk: ./ docs/ xdocs/]
[oval:org.mitre.oval:def:17215]
[oval:org.mitre.oval:def:19518]
[oval:org.mitre.oval:def:19667]
[oval:org.mitre.oval:def:19718]
The dissect_oampdu_event_notification function in epan/dissectors/packet-slowprotocols.c in the IEEE 802.3 Slow Protocols dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle certain short lengths, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-slowprotocols.c?r1=46336&r2=46335&pathrev=46336]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46336]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8036]
[oval:org.mitre.oval:def:16423]
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-csn1.c?r1=46335&r2=46334&pathrev=46335]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46335]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8037]
[oval:org.mitre.oval:def:16016]
The dissect_bthci_eir_ad_data function in epan/dissectors/packet-bthci_cmd.c in the Bluetooth HCI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a counter variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-bthci_cmd.c?r1=46345&r2=46344&pathrev=46345]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46345]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8038]
[oval:org.mitre.oval:def:16323]
The dissect_r3_cmd_alarmconfigure function in epan/dissectors/packet-assa_r3.c in the R3 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a certain alarm length, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-assa_r3.c?r1=46415&r2=46414&pathrev=46415]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46415]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8040]
[oval:org.mitre.oval:def:16291]
The dissect_sdp_media_attribute function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly process crypto-suite parameters, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sdp.c?r1=46344&r2=46343&pathrev=46344]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46344]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8041]
[oval:org.mitre.oval:def:16450]
The dissect_sip_p_charging_func_addresses function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle offset data associated with a quoted string, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-sip.c?r1=46340&r2=46339&pathrev=46340]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46340]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8042]
[oval:org.mitre.oval:def:16253]
The dissect_pw_eth_heuristic function in epan/dissectors/packet-pw-eth.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle apparent Ethernet address values at the beginning of MPLS data, which allows remote attackers to cause a denial of service (loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-pw-eth.c?r1=46420&r2=46419&pathrev=46420]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46420]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8043]
[oval:org.mitre.oval:def:16205]
The rtps_util_add_bitmap function in epan/dissectors/packet-rtps.c in the RTPS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly implement certain nested loops for processing bitmap data, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-rtps.c?r1=47046&r2=47045&pathrev=47046]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=47046]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8198]
[oval:org.mitre.oval:def:16230]
The dissect_cmstatus_tlv function in plugins/docsis/packet-cmstatus.c in the DOCSIS CM-STATUS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a position variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/plugins/docsis/packet-cmstatus.c?r1=47045&r2=47044&pathrev=47045]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=47045]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8199]
[oval:org.mitre.oval:def:15509]
The dissect_pft_fec_detailed function in epan/dissectors/packet-dcp-etsi.c in the DCP-ETSI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle fragment gaps, which allows remote attackers to cause a denial of service (loop) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=47123&r2=47122&pathrev=47123]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=47123]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-01.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8222]
[oval:org.mitre.oval:def:16370]
The dissect_clnp function in epan/dissectors/packet-clnp.c in the CLNP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly manage an offset variable, which allows remote attackers to cause a denial of service (infinite loop or application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-clnp.c?r1=45646&r2=45645&pathrev=45646]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=45646]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[DSA-2625]
[http://www.wireshark.org/security/wnpa-sec-2013-02.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7871]
[oval:org.mitre.oval:def:16426]
The dissect_version_4_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dtn.c?r1=46577&r2=46576&pathrev=46577]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46577]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-03.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7945]
[oval:org.mitre.oval:def:16304]
The dissect_version_5_and_6_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dtn.c?r1=46579&r2=46578&pathrev=46579]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46579]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-03.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7945]
[oval:org.mitre.oval:def:16092]
epan/tvbuff.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly validate certain length values for the MS-MMC dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/tvbuff.c?r1=46705&r2=46704&pathrev=46705]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46705]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-04.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8112]
[oval:org.mitre.oval:def:15801]
The fragment_set_tot_len function in epan/reassemble.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly determine the length of a reassembled packet for the DTLS dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/reassemble.c?r1=46999&r2=46998&pathrev=46999]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=46999]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[DSA-2625]
[http://www.wireshark.org/security/wnpa-sec-2013-05.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8111]
[oval:org.mitre.oval:def:16048]
The dissect_rohc_ir_packet function in epan/dissectors/packet-rohc.c in the ROHC dissector in Wireshark 1.8.x before 1.8.5 does not properly handle unknown profiles, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-rohc.c?r1=44700&r2=44699&pathrev=44700]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=44700]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-06.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7679]
[oval:org.mitre.oval:def:16462]
Multiple buffer overflows in the dissect_pft_fec_detailed function in the DCP-ETSI dissector in epan/dissectors/packet-dcp-etsi.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allow remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/dissectors/packet-dcp-etsi.c?r1=47098&r2=47097&pathrev=47098]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=47098]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[DSA-2625]
[http://www.wireshark.org/security/wnpa-sec-2013-07.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8213]
[oval:org.mitre.oval:def:16402]
Double free vulnerability in epan/proto.c in the dissection engine in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[http://anonsvn.wireshark.org/viewvc/trunk/epan/proto.c?r1=47114&r2=47113&pathrev=47114]
[http://anonsvn.wireshark.org/viewvc?view=revision&revision=47114]
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[http://www.wireshark.org/security/wnpa-sec-2013-08.html]
[https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8197]
[oval:org.mitre.oval:def:16319]
Buffer overflow in the NTLMSSP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.
[openSUSE-SU-2013:0276]
[openSUSE-SU-2013:0285]
[DSA-2625]
[http://www.wireshark.org/security/wnpa-sec-2013-09.html]
[oval:org.mitre.oval:def:16004]
Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors. NOTE: this issue might be resultant from an integer overflow in the fast_composite_scaled_bilinear function in pixman-inlines.h, which triggers an infinite loop.
Adding additional products per
http://rhn.redhat.com/errata/RHSA-2013-0687.html
Red Hat Enterprise Linux 6
http://rhn.redhat.com/errata/RHSA-2013-0746.html
Red Hat Enterprise Virtualization 3
[http://cgit.freedesktop.org/pixman/commit/?id=de60e2e0e3eb6084f8f14b63f25b3cbfb012943f]
[RHSA-2013:0687]
[RHSA-2013:0746]
[MDVSA-2013:116]
[http://www.palemoon.org/releasenotes-ng.shtml]
[https://bugzilla.redhat.com/show_bug.cgi?id=910149]
[https://support.f5.com/csp/article/K51392553]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0077]
Directory traversal vulnerability in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.
Per: http://www.coresecurity.com/advisories/maygion-IP-cameras-multiple-vulnerabilities
"Multiple vulnerabilities have been found in MayGion IP cameras [1] based on firmware v09.27 and below"
[20130528 CORE-2013-0322 - MayGion IP Cameras multiple vulnerabilities]
[http://www.coresecurity.com/advisories/maygion-IP-cameras-multiple-vulnerabilities]
[25813]
[60192]
[maygion-ipcamera-cve20131604-dir-traversal(84589)]
Buffer overflow in MayGion IP Cameras with firmware before 2013.04.22 (05.53) allows remote attackers to execute arbitrary code via a long filename in a GET request.
Per: http://www.coresecurity.com/advisories/maygion-IP-cameras-multiple-vulnerabilities
"Multiple vulnerabilities have been found in MayGion IP cameras [1] based on firmware v09.27 and below"
[http://packetstormsecurity.com/files/121787/MayGion-IP-Camera-Path-Traversal-Buffer-Overflow.html]
[20130528 CORE-2013-0322 - MayGion IP Cameras multiple vulnerabilities]
[http://www.coresecurity.com/advisories/maygion-IP-cameras-multiple-vulnerabilities]
[25813]
[60196]
[maygion-ipcamera-cve20131605-bo(84590)]
Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers to execute arbitrary code via a long rtsp: URI in a DESCRIBE request.
Per: http://www.coresecurity.com/advisories/buffer-overflow-ubiquiti-aircam-rtsp-service
'Vulnerable Packages
Cameras Models: airCam, airCam Mini, airCam Dome.
Firmware Version Verified: AirCam v1.1.5.'
[http://www.coresecurity.com/advisories/buffer-overflow-ubiquiti-aircam-rtsp-service]
[26138]
Directory traversal vulnerability in the Management Console on the Symantec NetBackup (NBU) appliance 2.0.x allows remote attackers to read arbitrary files via unspecified vectors.
[58542]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130320_00]
Multiple unquoted Windows search path vulnerabilities in the (1) File Collector and (2) File PlaceHolder services in Symantec Enterprise Vault (EV) for File System Archiving before 9.0.4 and 10.x before 10.0.1 allow local users to gain privileges via a Trojan horse program.
[58617]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130321_00]
Unquoted Windows search path vulnerability in RDDService in Symantec PGP Desktop 10.0.x through 10.2.x and Symantec Encryption Desktop 10.3.0 before MP3 allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory.
Per: http://cwe.mitre.org/data/definitions/426.html
'Untrusted Search Path CWE-426'
[61489]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130801_01]
Multiple cross-site scripting (XSS) vulnerabilities in administrative-interface pages in the management console in Symantec Brightmail Gateway 9.5.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
[59700]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130508_00]
Buffer overflow in secars.dll in the management console in Symantec Endpoint Protection Manager (SEPM) 12.1.x before 12.1.3, and Symantec Endpoint Protection Center (SPC) Small Business Edition 12.0.x, allows remote attackers to execute arbitrary code via unspecified vectors.
[60542]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20130618_00]
SQL injection vulnerability in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
[60796]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00]
Multiple cross-site scripting (XSS) vulnerabilities in the management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[60797]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00]
The management console (aka Java console) on the Symantec Security Information Manager (SSIM) appliance 4.7.x and 4.8.x before 4.8.1 allows remote attackers to obtain sensitive information via unspecified web-GUI API calls.
[60798]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130701_00]
The management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allows remote attackers to execute arbitrary commands by injecting a command into an application script.
[http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html]
[61106]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130726-0_Symantec_Web_Gateway_Multiple_Vulnerabilities_v10.txt]
Multiple SQL injection vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote authenticated administrators to execute arbitrary SQL commands via unspecified vectors.
[http://packetstormsecurity.com/files/122556/Symantec-Web-Gateway-XSS-CSRF-SQL-Injection-Command-Injection.html]
[61101]
[http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20130725_00]
[https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130726-0_Symantec_Web_Gateway_Multiple_Vulnerabilities_v10.txt]
The TLS implementation in Opera before 12.13 does not properly consider timing side-channel attacks on a MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
[openSUSE-SU-2013:0289]
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[http://www.opera.com/docs/changelogs/unified/1213/]
[http://www.opera.com/support/kb/view/1044/]
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
[SUSE-SU-2014:0320]
[SUSE-SU-2014:0322]
[openSUSE-SU-2014:0346]
[openSUSE-SU-2013:0807]
[http://nmav.gnutls.org/2013/02/time-is-money-for-cbc-ciphersuites.html]
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[RHSA-2013:0588]
[http://www.gnutls.org/security.html#GNUTLS-SA-2013-1]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[USN-1752-1]
[https://gitorious.org/gnutls/gnutls/commit/328ee22c1b3951e060c7124c7cb1cee592c59bc0]
[https://gitorious.org/gnutls/gnutls/commit/b8391806cd79095fe566f2401d8c7ad85a64b198]
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[openSUSE-SU-2013:0630]
[openSUSE-SU-2013:0631]
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[RHSA-2013:1135]
[RHSA-2013:1144]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[GLSA-201406-19]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[57777]
[64758]
[USN-1763-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
Array index error in the SSL module in PolarSSL before 1.2.5 might allow remote attackers to cause a denial of service via vectors involving a crafted padding-length value during validation of CBC padding in a TLS session, a different vulnerability than CVE-2013-0169.
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[DSA-2622]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[https://polarssl.org/tech-updates/releases/polarssl-1.2.5-released]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is not a security issue. Further investigation showed that, because of RFC noncompliance, no version or configuration of the product had the vulnerability previously associated with this ID. Notes: none.
The TLS and DTLS implementations in wolfSSL CyaSSL before 2.5.0 do not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[GLSA-201308-06]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
[http://www.yassl.com/yaSSL/Blog/Entries/2013/2/5_WolfSSL%2C_provider_of_CyaSSL_Embedded_SSL%2C_releases_first_embedded_TLS_and_DTLS_protocol_fix_for_Lucky_Thirteen_Attack.html]
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
[[oss-security] 20130205 Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations]
[RHSA-2014:0371]
[RHSA-2014:0372]
[http://www.isg.rhul.ac.uk/tls/TLStiming.pdf]
Absolute path traversal vulnerability in NTWebServer.exe in Indusoft Studio 7.0 and earlier and Advantech Studio 7.0 and earlier allows remote attackers to read arbitrary files via a full pathname in an argument to the sub_401A90 CreateFileW function.
[http://ics-cert.us-cert.gov/pdf/ICSA-13-067-01.pdf]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2013. Notes: none.
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.
[http://www.pip-installer.org/en/latest/installing.html]
[http://www.pip-installer.org/en/latest/news.html#changelog]
[http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/]
[https://bugzilla.redhat.com/show_bug.cgi?id=968059]
[https://github.com/pypa/pip/issues/425]
[https://github.com/pypa/pip/pull/791/files]
pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.
[http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/]
[https://github.com/mardiros/pyshop/blob/master/CHANGES.txt]
[https://github.com/mardiros/pyshop/commit/ffadb0bcdef1e385884571670210cfd6ba351784]
easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.
[http://www.reddit.com/r/Python/comments/17rfh7/warning_dont_use_pip_in_an_untrusted_network_a/]
[https://pypi.python.org/pypi/setuptools/0.9.8#changes]
ext/soap/soap.c in PHP before 5.3.22 and 5.4.x before 5.4.13 does not validate the relationship between the soap.wsdl_cache_dir directive and the open_basedir directive, which allows remote attackers to bypass intended access restrictions by triggering the creation of cached SOAP WSDL files in an arbitrary directory.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221]
[http://git.php.net/?p=php-src.git;a=blob;f=NEWS;h=36f6f9a4396d3034cc903a4271e7fdeccc5d3ea6;hb=refs/heads/PHP-5.4]
[http://git.php.net/?p=php-src.git;a=blob;f=NEWS;h=82afa3a040e639f3595121e45b850d5453906a00;hb=refs/heads/PHP-5.3]
[http://git.php.net/?p=php-src.git;a=commitdiff;h=702b436ef470cc02f8e2cc21f2fadeee42103c74]
[APPLE-SA-2013-09-12-1]
[SUSE-SU-2013:1285]
[SUSE-SU-2013:1315]
[http://support.apple.com/kb/HT5880]
[DSA-2639]
[MDVSA-2013:114]
[https://bugs.gentoo.org/show_bug.cgi?id=459904]
[https://bugzilla.redhat.com/show_bug.cgi?id=918196]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101]
Cross-site scripting (XSS) vulnerability in open-flash-chart.swf in Open Flash Chart (aka Open-Flash Chart), as used in the Pretty Link Lite plugin before 1.6.3 for WordPress, JNews (com_jnews) component 8.0.1 for Joomla!, and CiviCRM 3.1.0 through 4.2.9 and 4.3.0 through 4.3.3, allows remote attackers to inject arbitrary web script or HTML via the get-data parameter.
[20130220 [CVE-2013-1636]Wordpress pretty-link plugin XSS in SWF‏]
[http://packetstormsecurity.com/files/120433/WordPress-Pretty-Link-1.6.3-Cross-Site-Scripting.html]
[http://packetstormsecurity.com/files/121623/Joomla-Jnews-8.0.1-Cross-Site-Scripting.html]
[http://wordpress.org/plugins/pretty-link/changelog]
[https://civicrm.org/advisory/civi-sa-2013-002-openflashchart-xss]
[prettylinklite-openflashchart-xss(82242)]
Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.
[openSUSE-SU-2013:0289]
[http://www.opera.com/docs/changelogs/unified/1213/]
[http://www.opera.com/support/kb/view/1042/]
Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.
[openSUSE-SU-2013:0289]
[http://www.opera.com/docs/changelogs/unified/1213/]
[http://www.opera.com/support/kb/view/1043/]
Opera before 12.13 does not send CORS preflight requests in all required cases, which allows remote attackers to bypass a CSRF protection mechanism via a crafted web site that triggers a CORS request.
[openSUSE-SU-2013:0289]
[http://www.opera.com/docs/changelogs/unified/1213/]
[http://www.opera.com/support/kb/view/1045/]
The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.
Per http://www.ubuntu.com/usn/usn-1759-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[SUSE-SU-2013:0618]
[openSUSE-SU-2013:0641]
[RHSA-2013:0710]
[USN-1759-1]
[DSA-2643]
[https://puppetlabs.com/security/cve/cve-2013-1640/]
Directory traversal vulnerability in the zip download functionality in QuiXplorer before 2.5.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the selitems[] parameter in a download_selected action to index.php.
[quixplorer-cve20131641-dir-traversal(89059)]
[https://github.com/realtimeprojects/quixplorer]
[https://github.com/realtimeprojects/quixplorer/blob/v2.5.5/doc/RELEASES.md]
[https://github.com/realtimeprojects/quixplorer/commit/7ac119cebd3b6bfe16a30fd1d5290127310a4436]
[https://www3.trustwave.com/spiderlabs/advisories/TWSL2013-030.txt]
The SOAP parser in PHP before 5.3.23 and 5.4.x before 5.4.13 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2013-1824.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702221]
[http://git.php.net/?p=php-src.git;a=commit;h=8e76d0404b7f664ee6719fd98f0483f0ac4669d6]
[APPLE-SA-2013-09-12-1]
[SUSE-SU-2013:1285]
[SUSE-SU-2013:1315]
[RHSA-2013:1307]
[RHSA-2013:1615]
[http://support.apple.com/kb/HT5880]
[DSA-2639]
[MDVSA-2013:114]
[http://www.php.net/ChangeLog-5.php]
[USN-1761-1]
[https://bugs.gentoo.org/show_bug.cgi?id=459904]
[https://bugzilla.redhat.com/show_bug.cgi?id=918187]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0101]
Directory traversal vulnerability in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the publication template path.
[20130313 Open-Xchange Security Advisory 2013-03-13]
Multiple cross-site scripting (XSS) vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary web script or HTML via (1) invalid JSON data in a mail-sending POST request, (2) an arbitrary parameter to servlet/TestServlet, (3) a javascript: URL in a standalone-mode action to a UWA module, (4) an infostore attachment, (5) JavaScript code in a contact image, (6) an RSS feed, or (7) a signature.
[20130313 Open-Xchange Security Advisory 2013-03-13]
Multiple CRLF injection vulnerabilities in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 allow remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted parameter, as demonstrated by (1) the location parameter to ajax/redirect or (2) multiple infostore URIs.
[20130313 Open-Xchange Security Advisory 2013-03-13]
The Subscriptions feature in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not properly validate the publication-source URL, which allows remote authenticated users to trigger arbitrary outbound TCP traffic via a crafted Source field, as demonstrated by (1) an ftp: URL, (2) a gopher: URL, or (3) an http://127.0.0.1/ URL, related to a "Server-side request forging (SSRF)" issue.
[20130313 Open-Xchange Security Advisory 2013-03-13]
Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses the crypt and SHA-1 algorithms for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack.
[20130313 Open-Xchange Security Advisory 2013-03-13]
Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 uses weak permissions (group "other" readable) under opt/open-xchange/etc/, which allows local users to obtain sensitive information via standard filesystem operations.
[20130313 Open-Xchange Security Advisory 2013-03-13]
OXUpdater in Open-Xchange Server before 6.20.7 rev14, 6.22.0 before rev13, and 6.22.1 before rev14 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof update servers and install arbitrary software via a crafted certificate.
[20130313 Open-Xchange Security Advisory 2013-03-13]
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.
Per http://www.ubuntu.com/usn/usn-1759-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[SUSE-SU-2013:0618]
[openSUSE-SU-2013:0641]
[RHSA-2013:0710]
[USN-1759-1]
[DSA-2643]
[58443]
[https://puppetlabs.com/security/cve/cve-2013-1652/]
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.
per http://www.ubuntu.com/usn/usn-1759-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[SUSE-SU-2013:0618]
[openSUSE-SU-2013:0641]
[USN-1759-1]
[DSA-2643]
[58446]
[https://puppetlabs.com/security/cve/cve-2013-1653/]
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.
Per http://www.ubuntu.com/usn/usn-1759-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
"
[SUSE-SU-2013:0618]
[openSUSE-SU-2013:0641]
[RHSA-2013:0710]
[USN-1759-1]
[DSA-2643]
[64758]
[https://puppetlabs.com/security/cve/cve-2013-1654/]
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."
Per http://www.ubuntu.com/usn/usn-1759-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
"
[SUSE-SU-2013:0618]
[openSUSE-SU-2013:0641]
[USN-1759-1]
[DSA-2643]
[58442]
[https://puppetlabs.com/security/cve/cve-2013-1655/]
Spree Commerce 1.0.x through 1.3.2 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the (1) payment_method parameter to core/app/controllers/spree/admin/payment_methods_controller.rb; and the (2) promotion_action parameter to promotion_actions_controller.rb, (3) promotion_rule parameter to promotion_rules_controller.rb, and (4) calculator_type parameter to promotions_controller.rb in promo/app/controllers/spree/admin/, related to unsafe use of the constantize function.
[http://blog.conviso.com.br/2013/03/spree-commerce-multiple-unsafe.html]
[http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed]
[https://www.conviso.com.br/advisories/CVE-2013-1656.txt]
VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption) by modifying the client-server data stream.
[http://www.vmware.com/security/advisories/VMSA-2013-0003.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none.
VMware ESXi 4.0 through 5.1, and ESX 4.0 and 4.1, does not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to cause a denial of service (unhandled exception and application crash) by modifying the client-server data stream.
[http://www.vmware.com/security/advisories/VMSA-2013-0011.html]
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function.
Per: http://www.vmware.com/security/advisories/VMSA-2013-0010.html
"The issue is present when Workstation or Player are installed on a Debian-based version of Linux."
[http://blog.cmpxchg8b.com/2013/08/security-debianisms.html]
[http://www.vmware.com/security/advisories/VMSA-2013-0010.html]
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.
[http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html]
[http://bugs.python.org/issue17239]
[[openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)]
[RHSA-2013:0657]
[RHSA-2013:0658]
[RHSA-2013:0670]
[USN-1757-1]
[[oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)]
[[oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280]
[https://bugs.launchpad.net/nova/+bug/1100282]
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.
[http://blog.python.org/2013/02/announcing-defusedxml-fixes-for-xml.html]
[http://bugs.python.org/issue17239]
[[openstack-announce] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)]
[RHSA-2013:0657]
[RHSA-2013:0658]
[RHSA-2013:0670]
[USN-1757-1]
[DSA-2634]
[[oss-security] 20130219 [OSSA 2013-004] Information leak and Denial of Service using XML entities (CVE-2013-1664, CVE-2013-1665)]
[[oss-security] 20130219 REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280]
[https://bugs.launchpad.net/keystone/+bug/1100279]
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705]
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735]
[APPLE-SA-2013-10-22-3]
[SSRT101274]
[http://perl5.git.perl.org/perl.git/commitdiff/6e79fe5]
[http://perl5.git.perl.org/perl.git/commitdiff/9d83adc]
[http://perl5.git.perl.org/perl.git/commitdiff/d59e31f]
[RHSA-2013:0685]
[DSA-2641]
[MDVSA-2013:113]
[[perl.perl5.porters] 20130304 CVE-2013-1667: important rehashing flaw]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[58311]
[USN-1770-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=912276]
[perl-rehash-dos(82598)]
[oval:org.mitre.oval:def:18771]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0094]
The uploadFile function in upload/index.php in CosCMS before 1.822 allows remote administrators to execute arbitrary commands via shell metacharacters in the name of an uploaded file.
[20130306 OS Command Injection in CosCms]
[http://www.coscms.org/blog/view/4/Version-1.822]
[24629]
[58332]
[https://github.com/diversen/gallery/commit/7d58f870e8edc6597485dd1b80ea9fb78580190c]
[https://www.htbridge.com/advisory/HTB23145]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 21.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[http://www.mozilla.org/security/announce/2013/mfsa2013-41.html]
[59870]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=791432]
[https://bugzilla.mozilla.org/show_bug.cgi?id=803228]
[https://bugzilla.mozilla.org/show_bug.cgi?id=814552]
[https://bugzilla.mozilla.org/show_bug.cgi?id=819775]
[https://bugzilla.mozilla.org/show_bug.cgi?id=821479]
[https://bugzilla.mozilla.org/show_bug.cgi?id=821850]
[https://bugzilla.mozilla.org/show_bug.cgi?id=822910]
[https://bugzilla.mozilla.org/show_bug.cgi?id=826104]
[https://bugzilla.mozilla.org/show_bug.cgi?id=826392]
[https://bugzilla.mozilla.org/show_bug.cgi?id=826588]
[https://bugzilla.mozilla.org/show_bug.cgi?id=834526]
[https://bugzilla.mozilla.org/show_bug.cgi?id=837007]
[https://bugzilla.mozilla.org/show_bug.cgi?id=837324]
[https://bugzilla.mozilla.org/show_bug.cgi?id=843434]
[https://bugzilla.mozilla.org/show_bug.cgi?id=854001]
[https://bugzilla.mozilla.org/show_bug.cgi?id=855236]
[https://bugzilla.mozilla.org/show_bug.cgi?id=865948]
[oval:org.mitre.oval:def:16493]
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 does not prevent acquisition of chrome privileges during calls to content level constructors, which allows remote attackers to bypass certain read-only restrictions and conduct cross-site scripting (XSS) attacks via a crafted web site.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[34363]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-42.html]
[93427]
[59865]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=853709]
[oval:org.mitre.oval:def:17046]
Mozilla Firefox before 21.0 does not properly implement the INPUT element, which allows remote attackers to obtain the full pathname via a crafted web site.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0946]
[http://www.mozilla.org/security/announce/2013/mfsa2013-43.html]
[USN-1822-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=842255]
[oval:org.mitre.oval:def:17100]
The Mozilla Maintenance Service in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 on Windows allows local users to bypass integrity verification and gain privileges via vectors involving junctions.
[http://www.mozilla.org/security/announce/2013/mfsa2013-44.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=850492]
[oval:org.mitre.oval:def:16915]
The Mozilla Updater in Mozilla Firefox before 21.0 on Windows does not properly maintain Mozilla Maintenance Service registry entries in certain situations involving upgrades from older Firefox versions, which allows local users to gain privileges by leveraging write access to a "trusted path."
[http://www.mozilla.org/security/announce/2013/mfsa2013-45.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=854088]
[oval:org.mitre.oval:def:17125]
Use-after-free vulnerability in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-46.html]
[59859]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=860971]
[oval:org.mitre.oval:def:17147]
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-47.html]
[59858]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=866825]
[oval:org.mitre.oval:def:16976]
The SelectionIterator::GetNextSegment function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59863]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=818454]
[oval:org.mitre.oval:def:16956]
The gfxSkipCharsIterator::SetOffsets function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59868]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=826163]
[oval:org.mitre.oval:def:16979]
The _cairo_xlib_surface_add_glyph function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59864]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=839745]
[oval:org.mitre.oval:def:16577]
Use-after-free vulnerability in the mozilla::plugins::child::_geturlnotify function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59860]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=848237]
[oval:org.mitre.oval:def:17085]
Use-after-free vulnerability in the nsFrameList::FirstChild function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59861]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=850931]
[oval:org.mitre.oval:def:17031]
Use-after-free vulnerability in the nsContentUtils::RemoveScriptBlocker function in Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:0825]
[openSUSE-SU-2013:0831]
[openSUSE-SU-2013:0834]
[openSUSE-SU-2013:0929]
[openSUSE-SU-2013:0946]
[RHSA-2013:0820]
[RHSA-2013:0821]
[DSA-2699]
[MDVSA-2013:165]
[http://www.mozilla.org/security/announce/2013/mfsa2013-48.html]
[59862]
[USN-1822-1]
[USN-1823-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=851781]
[oval:org.mitre.oval:def:16988]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-49.html]
[60765]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=830389]
[https://bugzilla.mozilla.org/show_bug.cgi?id=840098]
[https://bugzilla.mozilla.org/show_bug.cgi?id=862309]
[https://bugzilla.mozilla.org/show_bug.cgi?id=867482]
[oval:org.mitre.oval:def:17392]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 22.0 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-49.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=822941]
[https://bugzilla.mozilla.org/show_bug.cgi?id=834732]
[https://bugzilla.mozilla.org/show_bug.cgi?id=846615]
[https://bugzilla.mozilla.org/show_bug.cgi?id=851418]
[https://bugzilla.mozilla.org/show_bug.cgi?id=862182]
[https://bugzilla.mozilla.org/show_bug.cgi?id=863454]
[https://bugzilla.mozilla.org/show_bug.cgi?id=865569]
[https://bugzilla.mozilla.org/show_bug.cgi?id=865883]
[https://bugzilla.mozilla.org/show_bug.cgi?id=876458]
[https://bugzilla.mozilla.org/show_bug.cgi?id=877287]
[oval:org.mitre.oval:def:17173]
Use-after-free vulnerability in the mozilla::dom::HTMLMediaElement::LookupMediaElementURITable function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-50.html]
[60766]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=865537]
[oval:org.mitre.oval:def:16604]
Use-after-free vulnerability in the nsIDocument::GetRootElement function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted web site.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-50.html]
[60773]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=871099]
[oval:org.mitre.oval:def:17330]
Use-after-free vulnerability in the mozilla::ResetDir function in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-50.html]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=876155]
[oval:org.mitre.oval:def:16576]
The System Only Wrapper (SOW) and Chrome Object Wrapper (COW) implementations in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly restrict XBL user-defined functions, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges, or conduct cross-site scripting (XSS) attacks, via a crafted web site.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-51.html]
[60777]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=863933]
[https://bugzilla.mozilla.org/show_bug.cgi?id=866823]
[oval:org.mitre.oval:def:17117]
The Profiler implementation in Mozilla Firefox before 22.0 parses untrusted data during UI rendering, which allows user-assisted remote attackers to execute arbitrary JavaScript code via a crafted web site.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-52.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=873966]
[oval:org.mitre.oval:def:16427]
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-53.html]
[60778]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=857883]
[https://bugzilla.mozilla.org/show_bug.cgi?id=901365]
[oval:org.mitre.oval:def:16996]
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not prevent the inclusion of body data in an XMLHttpRequest HEAD request, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a crafted web site.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-54.html]
[60783]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=866915]
[oval:org.mitre.oval:def:17096]
The SVG filter implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 allows remote attackers to read pixel values, and possibly bypass the Same Origin Policy and read text from a different domain, by observing timing differences in execution of filter code.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-55.html]
[60787]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=711043]
[oval:org.mitre.oval:def:17075]
The PreserveWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly handle the lack of a wrapper, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by leveraging unintended clearing of the wrapper cache's preserved-wrapper flag.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-56.html]
[60776]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=848535]
[oval:org.mitre.oval:def:17405]
Mozilla Firefox before 22.0 does not properly implement certain DocShell inheritance behavior for the sandbox attribute of an IFRAME element, which allows remote attackers to bypass intended access restrictions via a FRAME element within an IFRAME element.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-57.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=849791]
[oval:org.mitre.oval:def:16433]
Mozilla Firefox before 22.0 does not properly enforce the X-Frame-Options protection mechanism, which allows remote attackers to conduct clickjacking attacks via a crafted web site that uses the HTTP server push feature with multipart responses.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-58.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=761667]
[oval:org.mitre.oval:def:16992]
The XrayWrapper implementation in Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 does not properly restrict use of DefaultValue for method calls, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted web site that triggers use of a user-defined (1) toString or (2) valueOf method.
[openSUSE-SU-2013:1140]
[openSUSE-SU-2013:1141]
[openSUSE-SU-2013:1142]
[openSUSE-SU-2013:1143]
[SUSE-SU-2013:1152]
[SUSE-SU-2013:1153]
[RHSA-2013:0981]
[RHSA-2013:0982]
[DSA-2716]
[DSA-2720]
[http://www.mozilla.org/security/announce/2013/mfsa2013-59.html]
[60784]
[USN-1890-1]
[USN-1891-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=858101]
[oval:org.mitre.oval:def:17243]
The getUserMedia permission implementation in Mozilla Firefox before 22.0 references the URL of a top-level document instead of the URL of a specific page, which makes it easier for remote attackers to trick users into permitting camera or microphone access via a crafted web site that uses IFRAME elements.
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-60.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=876044]
[oval:org.mitre.oval:def:16791]
The Internationalized Domain Name (IDN) display algorithm in Mozilla Firefox before 22.0 does not properly handle the .com, .name, and .net top-level domains, which allows remote attackers to spoof the address bar via unspecified homograph characters.
[openSUSE-SU-2013:1142]
[http://www.mozilla.org/security/announce/2013/mfsa2013-61.html]
[USN-1890-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=840882]
[oval:org.mitre.oval:def:17296]
The Mozilla Maintenance Service in Mozilla Firefox before 22.0 on Windows does not properly handle inability to launch the Mozilla Updater executable file, which allows local users to gain privileges via vectors involving placement of a Trojan horse executable file at an arbitrary location.
[http://www.mozilla.org/security/announce/2013/mfsa2013-62.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=867056]
[oval:org.mitre.oval:def:17126]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-63.html]
[61874]
[https://bugzilla.mozilla.org/show_bug.cgi?id=880734]
[https://bugzilla.mozilla.org/show_bug.cgi?id=888107]
[oval:org.mitre.oval:def:18514]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[http://www.mozilla.org/security/announce/2013/mfsa2013-63.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=844088]
[https://bugzilla.mozilla.org/show_bug.cgi?id=854157]
[https://bugzilla.mozilla.org/show_bug.cgi?id=855331]
[https://bugzilla.mozilla.org/show_bug.cgi?id=858060]
[https://bugzilla.mozilla.org/show_bug.cgi?id=861530]
[https://bugzilla.mozilla.org/show_bug.cgi?id=862185]
[https://bugzilla.mozilla.org/show_bug.cgi?id=870200]
[https://bugzilla.mozilla.org/show_bug.cgi?id=874974]
[https://bugzilla.mozilla.org/show_bug.cgi?id=878703]
[https://bugzilla.mozilla.org/show_bug.cgi?id=879139]
[https://bugzilla.mozilla.org/show_bug.cgi?id=893684]
[oval:org.mitre.oval:def:18876]
Use-after-free vulnerability in the nsINode::GetParentNode function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors involving a DOM modification at the time of a SetBody mutation event.
[http://www.mozilla.org/security/announce/2013/mfsa2013-64.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=883313]
[oval:org.mitre.oval:def:18945]
Heap-based buffer underflow in the cryptojs_interpret_key_gen_type function in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Certificate Request Message Format (CRMF) request.
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1496]
[http://www.mozilla.org/security/announce/2013/mfsa2013-65.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=882865]
[oval:org.mitre.oval:def:18935]
Stack-based buffer overflow in maintenanceservice.exe in the Mozilla Maintenance Service in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line.
[http://www.mozilla.org/security/announce/2013/mfsa2013-66.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=888361]
[oval:org.mitre.oval:def:18930]
Stack-based buffer overflow in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 allows local users to gain privileges via a long pathname on the command line to the Mozilla Maintenance Service.
[http://www.mozilla.org/security/announce/2013/mfsa2013-66.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=888314]
[oval:org.mitre.oval:def:18871]
Mozilla Firefox before 23.0 and SeaMonkey before 2.20 allow remote attackers to cause a denial of service (application crash) via a crafted WAV file that is not properly handled by the nsCString::CharAt function.
[http://www.mozilla.org/security/announce/2013/mfsa2013-67.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=879924]
[oval:org.mitre.oval:def:18803]
Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly handle the interaction between FRAME elements and history, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving spoofing a relative location in a previously visited document.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-68.html]
[61867]
[https://bugzilla.mozilla.org/show_bug.cgi?id=848253]
[oval:org.mitre.oval:def:18531]
The crypto.generateCRMFRequest function in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 allows remote attackers to execute arbitrary JavaScript code or conduct cross-site scripting (XSS) attacks via vectors related to Certificate Request Message Format (CRMF) request generation.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-69.html]
[61900]
[https://bugzilla.mozilla.org/show_bug.cgi?id=871368]
[oval:org.mitre.oval:def:18773]
The XrayWrapper implementation in Mozilla Firefox before 23.0 and SeaMonkey before 2.20 does not properly address the possibility of an XBL scope bypass resulting from non-native arguments in XBL function calls, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks by leveraging access to an unprivileged object.
[http://www.mozilla.org/security/announce/2013/mfsa2013-70.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=843829]
[oval:org.mitre.oval:def:18830]
Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.
Per: http://cwe.mitre.org/data/definitions/426.html
CWE-426: Untrusted Search Path
[http://www.mozilla.org/security/announce/2013/mfsa2013-71.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=859072]
[oval:org.mitre.oval:def:18014]
Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 use an incorrect URI within unspecified comparisons during enforcement of the Same Origin Policy, which allows remote attackers to conduct cross-site scripting (XSS) attacks or install arbitrary add-ons via a crafted web site.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-72.html]
[61876]
[https://bugzilla.mozilla.org/show_bug.cgi?id=887098]
[oval:org.mitre.oval:def:18884]
The Web Workers implementation in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 does not properly restrict XMLHttpRequest calls, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via unspecified vectors.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-73.html]
[61882]
[https://bugzilla.mozilla.org/show_bug.cgi?id=879787]
[oval:org.mitre.oval:def:18002]
Multiple untrusted search path vulnerabilities in the (1) full installer and (2) stub installer in Mozilla Firefox before 23.0 on Windows allow local users to gain privileges via a Trojan horse DLL in the default downloads directory. NOTE: this issue exists because of an incomplete fix for CVE-2012-4206.
Per: http://cwe.mitre.org/data/definitions/426.html
CWE-426 Untrusted Search Path
[http://www.mozilla.org/security/announce/2013/mfsa2013-74.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=883165]
[oval:org.mitre.oval:def:18210]
Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, Thunderbird ESR 17.x before 17.0.8, and SeaMonkey before 2.20 do not properly restrict local-filesystem access by Java applets, which allows user-assisted remote attackers to read arbitrary files by leveraging a download to a fixed pathname or other predictable pathname.
[DSA-2735]
[DSA-2746]
[http://www.mozilla.org/security/announce/2013/mfsa2013-75.html]
[61896]
[https://bugzilla.mozilla.org/show_bug.cgi?id=406541]
[oval:org.mitre.oval:def:18367]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-76.html]
[62463]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=889193]
[https://bugzilla.mozilla.org/show_bug.cgi?id=897676]
[https://bugzilla.mozilla.org/show_bug.cgi?id=899022]
[https://bugzilla.mozilla.org/show_bug.cgi?id=901351]
[oval:org.mitre.oval:def:18939]
Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-76.html]
[62462]
[USN-1951-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=750932]
[https://bugzilla.mozilla.org/show_bug.cgi?id=847606]
[https://bugzilla.mozilla.org/show_bug.cgi?id=851982]
[https://bugzilla.mozilla.org/show_bug.cgi?id=854897]
[https://bugzilla.mozilla.org/show_bug.cgi?id=863935]
[https://bugzilla.mozilla.org/show_bug.cgi?id=871462]
[https://bugzilla.mozilla.org/show_bug.cgi?id=873073]
[https://bugzilla.mozilla.org/show_bug.cgi?id=876878]
[https://bugzilla.mozilla.org/show_bug.cgi?id=883450]
[https://bugzilla.mozilla.org/show_bug.cgi?id=893519]
[https://bugzilla.mozilla.org/show_bug.cgi?id=895294]
[https://bugzilla.mozilla.org/show_bug.cgi?id=896126]
[https://bugzilla.mozilla.org/show_bug.cgi?id=898381]
[https://bugzilla.mozilla.org/show_bug.cgi?id=898832]
[https://bugzilla.mozilla.org/show_bug.cgi?id=909494]
[oval:org.mitre.oval:def:19011]
The nsHtml5TreeBuilder::resetTheInsertionMode function in the HTML5 Tree Builder in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 does not properly maintain the state of the insertion-mode stack for template elements, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer over-read) by triggering use of this stack in its empty state.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-77.html]
[62465]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=888820]
[oval:org.mitre.oval:def:18617]
Integer overflow in the drawLineLoop function in the libGLESv2 library in Almost Native Graphics Layer Engine (ANGLE), as used in Mozilla Firefox before 24.0 and SeaMonkey before 2.21, allows remote attackers to execute arbitrary code via a crafted web site.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-78.html]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=890277]
[oval:org.mitre.oval:def:18993]
Use-after-free vulnerability in the nsAnimationManager::BuildAnimations function in the Animation Manager in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving stylesheet cloning.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-79.html]
[62460]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=893308]
[oval:org.mitre.oval:def:19031]
The NativeKey widget in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 processes key messages after destruction by a dispatched event listener, which allows remote attackers to cause a denial of service (application crash) by leveraging incorrect event usage after widget-memory reallocation.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-80.html]
[62472]
[https://bugzilla.mozilla.org/show_bug.cgi?id=891292]
[oval:org.mitre.oval:def:19028]
Use-after-free vulnerability in the mozilla::dom::HTMLFormElement::IsDefaultSubmitElement function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via vectors involving a destroyed SELECT element.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-81.html]
[62464]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=894137]
[oval:org.mitre.oval:def:18982]
Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not ensure that initialization occurs for JavaScript objects with compartments, which allows remote attackers to execute arbitrary code by leveraging incorrect scope handling.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-82.html]
[62467]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=876762]
[oval:org.mitre.oval:def:19025]
Mozilla Updater in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 does not ensure exclusive access to a MAR file, which allows local users to gain privileges by creating a Trojan horse file after MAR signature verification but before MAR use.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[http://www.mozilla.org/security/announce/2013/mfsa2013-83.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=890853]
[oval:org.mitre.oval:def:18821]
Mozilla Firefox before 24.0 on Android allows attackers to bypass the Same Origin Policy, and consequently conduct cross-site scripting (XSS) attacks or obtain password or cookie information, by using a symlink in conjunction with a file: URL for a local file.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[http://www.mozilla.org/security/announce/2013/mfsa2013-84.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=782581]
The IonMonkey JavaScript engine in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21, when Valgrind mode is used, does not properly initialize memory, which makes it easier for remote attackers to obtain sensitive information via unspecified vectors.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-85.html]
[62468]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=883686]
[oval:org.mitre.oval:def:18902]
The WebGL implementation in Mozilla Firefox before 24.0, when NVIDIA graphics drivers are used on Mac OS X, allows remote attackers to obtain desktop-screenshot data by reading from a CANVAS element.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[http://www.mozilla.org/security/announce/2013/mfsa2013-86.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=879656]
Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly handle movement of XBL-backed nodes between documents, which allows remote attackers to execute arbitrary code or cause a denial of service (JavaScript compartment mismatch, or assertion failure and application exit) via a crafted web site.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-88.html]
[62473]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=851353]
[oval:org.mitre.oval:def:19022]
Untrusted search path vulnerability in the GL tracing functionality in Mozilla Firefox before 24.0 on Android allows attackers to execute arbitrary code via a Trojan horse .so file in a world-writable directory.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[http://www.mozilla.org/security/announce/2013/mfsa2013-87.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=899702]
Buffer overflow in the nsFloatManager::GetFlowArea function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via crafted use of lists and floats within a multi-column layout.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-89.html]
[62469]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=883514]
[oval:org.mitre.oval:def:18520]
Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token.
[http://www.bugzilla.org/security/4.0.10/]
[https://bugzilla.mozilla.org/show_bug.cgi?id=911593]
Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via an update action.
[http://www.bugzilla.org/security/4.0.10/]
[https://bugzilla.mozilla.org/show_bug.cgi?id=913904]
Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-90.html]
[62479]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=898871]
[oval:org.mitre.oval:def:18443]
The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to improperly establishing parent-child relationships of range-request nodes.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-90.html]
[62478]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=906301]
[oval:org.mitre.oval:def:18856]
Mozilla Firefox before 24.0, Firefox ESR 17.x before 17.0.9, Thunderbird before 24.0, Thunderbird ESR 17.x before 17.0.9, and SeaMonkey before 2.21 do not properly identify the "this" object during use of user-defined getter methods on DOM proxies, which might allow remote attackers to bypass intended access restrictions via vectors involving an expando object.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1633]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1496]
[openSUSE-SU-2013:1499]
[RHSA-2013:1268]
[RHSA-2013:1269]
[DSA-2762]
[http://www.mozilla.org/security/announce/2013/mfsa2013-91.html]
[62475]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=907727]
[oval:org.mitre.oval:def:18789]
Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0, Thunderbird before 24.0, and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.
[FEDORA-2013-16992]
[FEDORA-2013-17074]
[FEDORA-2013-17047]
[openSUSE-SU-2013:1491]
[openSUSE-SU-2013:1493]
[openSUSE-SU-2013:1495]
[openSUSE-SU-2013:1499]
[http://www.mozilla.org/security/announce/2013/mfsa2013-92.html]
[62466]
[USN-1951-1]
[USN-1952-1]
[https://bugzilla.mozilla.org/show_bug.cgi?id=882897]
[https://bugzilla.mozilla.org/show_bug.cgi?id=887334]
[oval:org.mitre.oval:def:18766]
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[SUSE-SU-2013:1678]
[openSUSE-SU-2013:1539]
[openSUSE-SU-2013:1542]
[RHSA-2013:1791]
[RHSA-2013:1829]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[GLSA-201406-19]
[DSA-2790]
[http://www.mozilla.org/security/announce/2013/mfsa2013-93.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[62966]
[USN-2030-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=894370]
[https://bugzilla.redhat.com/show_bug.cgi?id=1012656]
[https://developer.mozilla.org/en-US/docs/NSS/NSS_3.15.2_release_notes]
[oval:org.mitre.oval:def:19254]
The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.
[openSUSE-SU-2014:0212]
[openSUSE-SU-2014:0213]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[64944]
[USN-2088-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://bugs.gentoo.org/show_bug.cgi?id=498172]
[https://bugzilla.mozilla.org/show_bug.cgi?id=919877]
[https://bugzilla.redhat.com/show_bug.cgi?id=1053725]
[https://developer.mozilla.org/docs/NSS/NSS_3.15.4_release_notes]
[mozilla-nss-cve20131740-info-disc(90394)]
Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value.
[http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10761]
[APPLE-SA-2015-06-30-1]
[APPLE-SA-2015-06-30-2]
[SUSE-SU-2013:1807]
[openSUSE-SU-2013:1732]
[RHSA-2013:1791]
[RHSA-2013:1829]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[GLSA-201406-19]
[http://support.apple.com/kb/HT204941]
[http://support.apple.com/kb/HT204942]
[DSA-2994]
[http://www.mozilla.org/security/announce/2013/mfsa2013-103.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html]
[http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html]
[http://www.oracle.com/technetwork/topics/security/cpujul2014-1972956.html]
[http://www.oracle.com/technetwork/topics/security/cpuoct2014-1972960.html]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities]
[63736]
[USN-2030-1]
[USN-2031-1]
[USN-2032-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0012.html]
[https://bugzilla.mozilla.org/show_bug.cgi?id=925100]
[https://developer.mozilla.org/docs/NSS/NSS_3.15.3_release_notes]
[GLSA-201504-01]
Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) sortkey parameter.
[http://www.bugzilla.org/security/4.0.10/]
[https://bugzilla.mozilla.org/show_bug.cgi?id=924802]
Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject arbitrary web script or HTML via a field value that is not properly handled during construction of a tabular report, as demonstrated by the (1) summary or (2) real name field. NOTE: this issue exists because of an incomplete fix for CVE-2012-4189.
[http://www.bugzilla.org/security/4.0.10/]
[https://bugzilla.mozilla.org/show_bug.cgi?id=924932]
channel.c in ngIRCd 20 and 20.1 allows remote attackers to cause a denial of service (assertion failure and crash) via a KICK command for a user who is not on the associated channel.
[[ngIRCd-ML] 20130215 ngIRCd 20.2]
[[ngIRCd-ML] 20130217 ngIRCd 20.2]
[FEDORA-2013-4593]
[http://ngircd.barton.de/doc/NEWS]
[https://arthur.barton.de/cgi-bin/gitweb.cgi?p=ngircd.git;h=0e63fb3fa7ac4ca048e8c2b648d2be3fd0572311]
Multiple SQL injection vulnerabilities in PHP Address Book 8.2.5 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) edit.php or (2) import.php. NOTE: the view.php id vector is already covered by CVE-2008-2565.1 and the edit.php id vector is already covered by CVE-2008-2565.2.
[[oss-security] 20130417 Multiple vulnerabilities in PHP Address Book v8.2.5]
[[oss-security] 20130417 Re: Multiple vulnerabilities in PHP Address Book v8.2.5]
Cross-site scripting (XSS) vulnerability in edit.php in PHP Address Book 8.2.5 allows user-assisted remote attackers to inject arbitrary web script or HTML via the Address field.
[[oss-security] 20130417 Multiple vulnerabilities in PHP Address Book v8.2.5]
Heap-based buffer overflow in RealNetworks RealPlayer before 16.0.1.18 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a malformed MP4 file.
[http://service.real.com/realplayer/security/03152013_player/en/]
** REJECT ** Various versions of Python do not properly restrict readline calls, which allows remote attackers to cause a denial of service (memory consumption) via a long string, related to (1) httplib - fixed in 2.7.4, 2.6.9, and 3.3.3; (2) ftplib - fixed in 2.7.6, 2.6.9, 3.3.3; (3) imaplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; (4) nntplib - fixed in 2.7.6, 2.6.9, 3.3.3; (5) poplib - not yet fixed in 2.7.x, fixed in 2.6.9, 3.3.3; and (6) smtplib - not yet fixed in 2.7.x, fixed in 2.6.9, not yet fixed in 3.3.x. NOTE: this was REJECTed because it is incompatible with CNT1 "Independently Fixable" in the CVE Counting Decisions.
The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby, when used with Ruby on Rails, allows remote attackers to execute arbitrary code via a crafted request.
[58225]
[dragonfly-ruby-code-exec(82476)]
[https://github.com/markevans/dragonfly/commit/a8775aacf9e5c81cf11bec34b7afa7f27ddfe277]
[https://groups.google.com/forum/?fromgroups=#!topic/dragonfly-users/3c3WIU3VQTo]
Cross-site scripting (XSS) vulnerability in the Marekkis Watermark plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the pfad parameter to wp-admin/options-general.php. NOTE: some of these details are obtained from third party information.
[20130218 Reflective XSS in Marekkis Watermark-Plugin Cross-Site Scripting Vulnerability]
[http://packetstormsecurity.com/files/120378/WordPress-Marekkis-Watermark-Cross-Site-Scripting.html]
Cross-site scripting (XSS) vulnerability in the Responsive Logo Slideshow plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the "URL and Image" field.
[20130218 Reflective/Stored XSS in Responsive Logo Slideshow Plugin Cross-Site Scripting Vulnerability]
[http://packetstormsecurity.com/files/120379/WordPress-Responsive-Logo-Slideshow-Cross-Site-Scripting.html]
[responsivelogoslideshow-url-image-xss(82164)]
[wpresponsivelogoslideshow-url-image-xss(82165)]
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.
[RHSA-2013:0714]
[DSA-2664]
[MDVSA-2013:130]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0097]
[https://www.stunnel.org/CVE-2013-1762.html]
Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0]
[openSUSE-SU-2013:0395]
[[oss-security] 20130225 Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[]]
[24555]
[24746]
[33336]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.10]
[MDVSA-2013:176]
[[oss-security] 20130224 Re: CVE Request: kernel - sock_diag: Fix out-of-bounds access to sock_diag_handlers[]]
[USN-1749-1]
[USN-1750-1]
[USN-1751-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=915052]
[https://github.com/torvalds/linux/commit/6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0]
The Zypper (aka zypp) backend in PackageKit before 0.8.8 allows local users to downgrade packages via the "install updates" method.
[openSUSE-SU-2013:0889]
[[oss-security] 20130225 Re: CVE Request: PackageKit"update" allows downgrade of packages when using the "zypp" backend]
[https://bugs.freedesktop.org/show_bug.cgi?id=61231]
[https://bugzilla.novell.com/show_bug.cgi?id=804983]
[https://gitorious.org/packagekit/packagekit/commit/d3d14631042237bcfe6fb30a60e59bb6d94af425]
[https://gitorious.org/packagekit/packagekit/source/NEWS]
Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter.
[[oss-security] 20130225 Re: CVE request: WordPress plugin smart-flv jwplayer.swf XSS]
[58135]
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.
[DSA-2650]
[58178]
Use-after-free vulnerability in the shmem_remount_fs function in mm/shmem.c in the Linux kernel before 3.7.10 allows local users to gain privileges or cause a denial of service (system crash) by remounting a tmpfs filesystem without specifying a required mpol (aka mempolicy) mount option.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5f00110f7273f9ff04ac69a5f85bb535a4fd0987]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[RHSA-2013:0744]
[RHSA-2013:0882]
[RHSA-2013:0928]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.10]
[MDVSA-2013:176]
[[oss-security] 20130225 Re: kernel: tmpfs use-after-free]
[USN-1787-1]
[USN-1788-1]
[USN-1792-1]
[USN-1793-1]
[USN-1794-1]
[USN-1795-1]
[USN-1796-1]
[USN-1797-1]
[USN-1798-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=915592]
[https://github.com/torvalds/linux/commit/5f00110f7273f9ff04ac69a5f85bb535a4fd0987]
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.
[20130612 [CVE-2013-1768] Apache OpenJPA security vulnerability]
[RHSA-2013:1862]
[http://svn.apache.org/viewvc?view=revision&revision=1462076]
[http://svn.apache.org/viewvc?view=revision&revision=1462225]
[http://svn.apache.org/viewvc?view=revision&revision=1462268]
[http://svn.apache.org/viewvc?view=revision&revision=1462318]
[http://svn.apache.org/viewvc?view=revision&revision=1462328]
[http://svn.apache.org/viewvc?view=revision&revision=1462488]
[http://svn.apache.org/viewvc?view=revision&revision=1462512]
[http://svn.apache.org/viewvc?view=revision&revision=1462558]
[http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html]
[60534]
[PM86780]
[PM86786]
[PM86788]
[PM86791]
[http://www-01.ibm.com/support/docview.wss?uid=swg21635999]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644047]
[openjpa-cve20131768-command-execution(82268)]
A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message.
[[Telepathy] 20130304 Announce: telepathy-gabble 0.16.5]
[[Telepathy] 20130304 Announce: telepathy-gabble 0.17.3]
[openSUSE-SU-2013:0518]
[USN-1873-1]
Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.
[[oss-security] 20130221 Re: CVE request: XSS flaws fixed in ganglia]
[[oss-security] 20130226 Re: CVE request: XSS flaws fixed in ganglia]
[https://bugzilla.redhat.com/show_bug.cgi?id=892823]
[ganglia-viewsview-xss(82468)]
[https://github.com/ganglia/ganglia-web/commit/552965f33bf79d41ccbec3f1f26840c8bab54ad6]
[https://github.com/ganglia/ganglia-web/issues/160]
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
[openSUSE-SU-2013:1187]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.33]
[[oss-security] 20130226 Re: CVE request -- Linux kernel: call_console_drivers() Function Log Prefix Stripping buffer overflow]
[https://bugzilla.redhat.com/show_bug.cgi?id=916075]
[https://github.com/torvalds/linux/commit/ce0030c00f95cf9110d9cdcd41e901e1fb814417]
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
Per https://access.redhat.com/security/cve/CVE-2013-1773
"This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd]
[RHSA-2013:0744]
[RHSA-2013:0928]
[RHSA-2013:1026]
[23248]
[http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.3.bz2]
[[oss-security] 20130226 Re: CVE request - Linux kernel: VFAT slab-based buffer overflow]
[58200]
[https://bugzilla.redhat.com/show_bug.cgi?id=916115]
[https://github.com/torvalds/linux/commit/0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd]
The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
Per https://access.redhat.com/security/cve/CVE-2013-1774
"This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this issue."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1ee0a224bc9aad1de496c795f96bc6ba2c394811]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[SUSE-SU-2013:1182]
[SUSE-SU-2013:1474]
[RHSA-2013:0744]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.4]
[[oss-security] 20130227 Re: CVE request: Linux kernel: USB: io_ti: NULL pointer dereference]
[USN-1805-1]
[USN-1808-1]
[http://xorl.wordpress.com/2013/05/18/cve-2013-1774-linux-kernel-edgeport-usb-serial-converter-null-pointer-dereference/]
[https://bugzilla.redhat.com/show_bug.cgi?id=916191]
[https://github.com/torvalds/linux/commit/1ee0a224bc9aad1de496c795f96bc6ba2c394811]
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2015-08-13-2]
[openSUSE-SU-2013:0495]
[RHSA-2013:1353]
[RHSA-2013:1701]
[http://support.apple.com/kb/HT5880]
[DSA-2642]
[[oss-security] 20130227 CVE request: sudo authentication bypass when clock is reset]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[58203]
[SSA:2013-065-01]
[http://www.sudo.ws/repos/sudo/rev/ddf399e3e306]
[http://www.sudo.ws/repos/sudo/rev/ebd6cc75020f]
[http://www.sudo.ws/sudo/alerts/epoch_ticket.html]
[USN-1754-1]
[https://support.apple.com/kb/HT205031]
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal. NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839]
[APPLE-SA-2015-08-13-2]
[openSUSE-SU-2013:0495]
[RHSA-2013:1353]
[DSA-2642]
[[oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets constraints]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[58207]
[SSA:2013-065-01]
[http://www.sudo.ws/repos/sudo/rev/632f8e028191]
[http://www.sudo.ws/repos/sudo/rev/6b22be4d09f0]
[http://www.sudo.ws/sudo/alerts/tty_tickets.html]
[https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023]
[https://bugzilla.redhat.com/show_bug.cgi?id=916365]
[sudo-ttytickets-sec-bypass(82453)]
[https://support.apple.com/kb/HT205031]
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
[20130701 [SECURITY] CVE-2013-1777: Apache Geronimo 3 RMI classloader exposure]
[http://geronimo.apache.org/30x-security-report.html]
[http://www-01.ibm.com/support/docview.wss?uid=swg21643282]
[https://issues.apache.org/jira/browse/GERONIMO-6477]
Cross-site scripting (XSS) vulnerability in the Creative Theme 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
[http://drupal.org/node/1929380]
[http://drupal.org/node/1929474]
[http://drupalcode.org/project/creative.git/commitdiff/465367c]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1723316]
[http://drupal.org/node/1929482]
[http://drupalcode.org/project/fresh.git/commitdiff/08a3ccb]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
[http://drupal.org/node/1929390]
[http://drupal.org/node/1929484]
[http://drupalcode.org/project/best_responsive.git/commitdiff/5972126]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
[58213]
[bestresponsive-socialicon-xss(82469)]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1730768]
[http://drupal.org/node/1929486]
[http://drupalcode.org/project/professional_theme.git/commitdiff/0640ddc]
[http://drupalcode.org/project/professional_theme.git/commitdiff/e3fa6a2]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
[http://drupal.org/node/1929396]
[http://drupal.org/node/1929488]
[http://drupalcode.org/project/responsive_blog.git/commitdiff/ce47de9]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
[58218]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1723246]
[http://drupal.org/node/1929496]
[http://drupalcode.org/project/business.git/commitdiff/02f081f]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
[58216]
[business-3slidegallery-xss(82460)]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1723532]
[http://drupal.org/node/1929500]
[http://drupalcode.org/project/clean_theme.git/commitdiff/697f839]
[http://drupalcode.org/project/clean_theme.git/commitdiff/ff2da6f]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1730752]
[http://drupal.org/node/1929508]
[http://drupalcode.org/project/responsive.git/commitdiff/1c6fa91]
[http://drupalcode.org/project/responsive.git/commitdiff/6b593ff]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1724232]
[http://drupal.org/node/1929512]
[http://drupalcode.org/project/company.git/commitdiff/9ddac7e]
[http://drupalcode.org/project/company.git/commitdiff/d9a99da]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1730786]
[http://drupal.org/node/1929514]
[http://drupalcode.org/project/corporate.git/commitdiff/679a1d3]
[[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules]
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=0388837f01bc467045164f9ddaff787000a8caaa]
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492]
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=957aa252912cde85d76c41e9710b33425a82b696]
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=bbc2d8918fe234b7ef2c480eb148943922cc0959]
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=e14b6e9c13d35c9bd1e0c50906ace8e707816888]
[http://j00ru.vexillium.org/?p=1507]
[FEDORA-2013-3473]
[FEDORA-2013-3457]
[USN-1785-1]
[DSA-2719]
[MDVSA-2013:143]
[[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes]
[[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes]
[https://bugzilla.redhat.com/show_bug.cgi?id=917108]
splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=a205e71a2dbe0c8d4f4905a76a3f79ec522eacec]
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=a9b8ab4657dec65b8b86c225d12c533ad7e984e2]
[http://j00ru.vexillium.org/?p=1507]
[FEDORA-2013-3473]
[FEDORA-2013-3457]
[USN-1785-1]
[[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes]
[[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes]
[https://bugzilla.redhat.com/show_bug.cgi?id=917109]
poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.
[http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=b1026b5978c385328f2a15a2185c599a563edf91]
[http://j00ru.vexillium.org/?p=1507]
[FEDORA-2013-3473]
[FEDORA-2013-3457]
[USN-1785-1]
[DSA-2719]
[MDVSA-2013:143]
[[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes]
[[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes]
[https://bugzilla.redhat.com/show_bug.cgi?id=917111]
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0da9dfdd2cd9889201bc6f6f43580c99165cd087]
[openSUSE-SU-2013:1187]
[openSUSE-SU-2014:0204]
[RHSA-2013:0744]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3]
[MDVSA-2013:176]
[[oss-security] 20130307 CVE-2013-1792 Linux kernel: KEYS: race with concurrent install_user_keyrings()]
[USN-1787-1]
[USN-1788-1]
[USN-1792-1]
[USN-1793-1]
[USN-1794-1]
[USN-1795-1]
[USN-1796-1]
[USN-1797-1]
[USN-1798-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=916646]
[https://github.com/torvalds/linux/commit/0da9dfdd2cd9889201bc6f6f43580c99165cd087]
Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.
[DSA-2638]
[MDVSA-2014:244]
[http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt]
[58299]
[openafs-fileserver-bo(82582)]
Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
[DSA-2638]
[MDVSA-2014:244]
[http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt]
[58300]
[openafs-ptserver-overflow(82585)]
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c300aa64ddf57d9c5d9c898a64b36877345dd4a9]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[openSUSE-SU-2013:1187]
[RHSA-2013:0727]
[RHSA-2013:0744]
[RHSA-2013:0746]
[RHSA-2013:0928]
[RHSA-2013:1026]
[MDVSA-2013:176]
[[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]]
[58607]
[USN-1805-1]
[USN-1808-1]
[USN-1809-1]
[USN-1812-1]
[USN-1813-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=917012]
[https://github.com/torvalds/linux/commit/c300aa64ddf57d9c5d9c898a64b36877345dd4a9]
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=0b79459b482e85cb7426aa7da683a9f2c97aeae1]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[openSUSE-SU-2013:1187]
[RHSA-2013:0727]
[RHSA-2013:0744]
[RHSA-2013:0746]
[RHSA-2013:0928]
[RHSA-2013:1026]
[MDVSA-2013:176]
[[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]]
[USN-1809-1]
[USN-1812-1]
[USN-1813-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=917013]
[https://github.com/torvalds/linux/commit/0b79459b482e85cb7426aa7da683a9f2c97aeae1]
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=a2c118bfab8bc6b8bb213abfc35201e441693d55]
[openSUSE-SU-2013:0847]
[openSUSE-SU-2013:0925]
[openSUSE-SU-2013:1187]
[RHSA-2013:0727]
[RHSA-2013:0744]
[RHSA-2013:0746]
[RHSA-2013:0928]
[RHSA-2013:1026]
[MDVSA-2013:176]
[[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]]
[USN-1809-1]
[USN-1812-1]
[USN-1813-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=917017]
[https://github.com/torvalds/linux/commit/a2c118bfab8bc6b8bb213abfc35201e441693d55]
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
Per http://www.ubuntu.com/usn/usn-1779-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[openSUSE-SU-2013:0301]
[USN-1779-1]
[https://bugzilla.gnome.org/show_bug.cgi?id=693214]
[https://bugzilla.gnome.org/show_bug.cgi?id=695106]
[https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8]
[[gnome-announce-list] 20130304 GNOME Online Accounts 3.6.3 released]
[[gnome-announce-list] 20130305 GNOME Online Accounts 3.7.91 released]
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
[SUSE-SU-2013:0615]
[https://bugzilla.novell.com/show_bug.cgi?id=804721]
[https://bugzilla.redhat.com/show_bug.cgi?id=917236]
[https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6]
[https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately]
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
[58260]
[https://bugzilla.redhat.com/show_bug.cgi?id=917229]
[https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031]
[https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately]
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
[SUSE-SU-2013:0612]
[https://bugzilla.redhat.com/show_bug.cgi?id=917233]
[https://github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d22879b5...4540e7102b803624cc2eade4bb8aaaa934fc31c5]
[https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately]
Multiple SQL injection vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to execute arbitrary SQL commands via the (1) orderby parameter to downloads.php; or remote authenticated users with certain permissions to execute arbitrary SQL commands via a (2) parameter name starting with "delete_attach_" in an edit action to forum/postedit.php; the (3) poll_opts[] parameter in a newthread action to forum/postnewthread.php; the (4) pm_email_notify, (5) pm_save_sent, (6) pm_inbox, (7) pm_sentbox, or (8) pm_savebox parameter to administration/settings_messages.php; the (9) thumb_compression, (10) photo_watermark_text_color1, (11) photo_watermark_text_color2, or (12) photo_watermark_text_color3 parameter to administration/settings_photo.php; the (13) enable parameter to administration/bbcodes.php; the (14) news_image, (15) news_image_t1, or (16) news_image_t2 parameter to administration/news.php; the (17) news_id parameter in an edit action to administration/news.php; or the (18) article_id parameter in an edit action to administration/articles.php. NOTE: the user ID cookie issue in Authenticate.class.php is already covered by CVE-2013-7375.
[http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html]
[20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05]
[[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097]
[[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097]
[http://www.php-fusion.co.uk/news.php?readmore=569]
[http://www.waraxe.us/advisory-97.html]
Multiple cross-site scripting (XSS) vulnerabilities in PHP-Fusion before 7.02.06 allow remote attackers to inject arbitrary web script or HTML via the (1) highlight parameter to forum/viewthread.php; or remote authenticated users with certain permissions to inject arbitrary web script or HTML via the (2) user_list or (3) user_types parameter to messages.php; (4) message parameter to infusions/shoutbox_panel/shoutbox_admin.php; (5) message parameter to administration/news.php; (6) panel_list parameter to administration/panel_editor.php; (7) HTTP User Agent string to administration/phpinfo.php; (8) "__BBCODE__" parameter to administration/bbcodes.php; errorMessage parameter to (9) article_cats.php, (10) download_cats.php, (11) news_cats.php, or (12) weblink_cats.php in administration/, when error is 3; or (13) body or (14) body2 parameter to administration/articles.php.
[http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html]
[20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05]
[[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097]
[[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097]
[http://www.php-fusion.co.uk/news.php?readmore=569]
[http://www.waraxe.us/advisory-97.html]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1806. Reason: This issue was MERGED into CVE-2013-1806 in accordance with CVE content decisions, because it is the same type of vulnerability and affects the same versions. Notes: All CVE users should reference CVE-2013-1806 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Multiple directory traversal vulnerabilities in PHP-Fusion before 7.02.06 allow remote authenticated users to include and execute arbitrary files via a .. (dot dot) in the (1) user_theme parameter to maincore.php; or remote authenticated administrators to delete arbitrary files via the (2) enable parameter to administration/user_fields.php or (3) file parameter to administration/db_backup.php.
[http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html]
[20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05]
[[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097]
[[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097]
[http://www.php-fusion.co.uk/news.php?readmore=569]
[http://www.waraxe.us/advisory-97.html]
PHP-Fusion before 7.02.06 stores backup files with predictable filenames in an unrestricted directory under the web document root, which might allow remote attackers to obtain sensitive information via a direct request to the backup file in administration/db_backups/.
[http://packetstormsecurity.com/files/120598/PHP-Fusion-7.02.05-XSS-LFI-SQL-Injection.html]
[20130228 [waraxe-2013-SA#097] - Multiple Vulnerabilities in PHP-Fusion 7.02.05]
[[oss-security] 20130303 CVE request: PHP-Fusion waraxe-2013-SA#097]
[[oss-security] 20130302 Re: CVE request: PHP-Fusion waraxe-2013-SA#097]
[http://www.php-fusion.co.uk/news.php?readmore=569]
[http://www.waraxe.us/advisory-97.html]
Cross-site scripting (XSS) vulnerability in ZeroClipboard.swf and ZeroClipboard10.swf in ZeroClipboard before 1.0.8, as used in em-shorty, RepRapCalculator, Fulcrum, Django, aCMS, and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter. NOTE: this is might be the same vulnerability as CVE-2013-1463. If so, it is likely that CVE-2013-1463 will be REJECTed.
[20130418 XSS vulnerabilities in ZeroClipboard in multiple plugins for WordPress]
[20130409 XSS and FPD vulnerabilities in ZeroClipboard in multiple themes for WordPress]
[20130218 XSS vulnerabilities in ZeroClipboard]
[20130220 XSS vulnerabilities in YAML, Multiproject for Trac, UserCollections for Piwigo, TAO and TableTools for DataTables for jQuery]
[20130301 XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS]
[http://securityvulns.ru/docs29103.html]
[http://securityvulns.ru/docs29104.html]
[http://securityvulns.ru/docs29105.html]
[http://www.cloudbees.com/jenkins-advisory/jenkins-security-advisory-2013-05-02.cb]
[[oss-security] 20130302 Re: [Full-disclosure] XSS vulnerabilities in em-shorty, RepRapCalculator, Fulcrum, Django and aCMS - ZeroClipboard.swf]
[[oss-security] 20130310 WordPress plugins vulnerable to CVE-2013-1808]
[[oss-security] 20130324 XSS vulnerabilities in ZeroClipboard and multiple web applications]
[[oss-security] 20130326 Re: WordPress plugins vulnerable to CVE-2013-1808]
[58257]
[https://github.com/jonrohan/ZeroClipboard/blob/master/docs/releases.md#zeroclipboard-108]
[https://github.com/jonrohan/ZeroClipboard/commit/a0e02933f5f7ce5f364fbad36a005f0a349f0696]
Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function.
[[oss-security] 20130119 CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability]
[[oss-security] 20130302 Re: CVE request: MantisBT 1.2.12 only summary.php category/project names XSS vulnerability]
[http://www.mantisbt.org/bugs/view.php?id=15384]
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.
[FEDORA-2013-20260]
[FEDORA-2013-20238]
[[oss-security] 20130302 Re: CVE request: ruby-openid XML denial of service attack]
[https://bugzilla.redhat.com/show_bug.cgi?id=918134]
[https://github.com/openid/ruby-openid/blob/master/CHANGELOG.md]
[https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed]
[https://github.com/openid/ruby-openid/pull/43]
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701965]
[http://git.busybox.net/busybox/commit/?id=4609f477c7e043a4f6147dfe6e86b775da2ef784]
[[busybox] 20130722 1.21.0 is released]
[http://packetstormsecurity.com/files/153278/WAGO-852-Industrial-Managed-Switch-Series-Code-Execution-Hardcoded-Credentials.html]
[RHSA-2013:1732]
[20190612 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series]
[20190613 SEC Consult SA-20190612-0 :: Multiple vulnerabilities in WAGO 852 Industrial Managed Switch Series]
[https://support.t-mobile.com/docs/DOC-21994]
The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
[20130312 [CVE-2013-1814] Apache Rave exposes User over API]
[24744]
PackStack 2012.2.3 in Red Hat OpenStack Essex and Folsom can create the answer file in insecure directories such as /tmp or the current working directory, which allows local users to modify deployed systems by changing this file.
[RHSA-2013:0671]
[https://bugzilla.redhat.com/show_bug.cgi?id=917904]
[packstack-answerfile-information-disclosure(83017)]
maintenance/mwdoc-filter.php in MediaWiki before 1.20.3 allows remote attackers to read arbitrary files via unspecified vectors.
[http://www.mediawiki.org/wiki/Release_notes/1.20]
[58304]
[https://bugzilla.wikimedia.org/show_bug.cgi?id=45355]
[mediawiki-cve20131818-info-disclosure(88363)]
The _xfs_buf_find function in fs/xfs/xfs_buf.c in the Linux kernel before 3.7.6 does not validate block numbers, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging the ability to mount an XFS filesystem containing a metadata inode with an invalid extent map.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=eb178619f930fa2ba2348de332a1ff1c66a31424]
[SUSE-SU-2013:1473]
[SUSE-SU-2013:1474]
[openSUSE-SU-2013:1971]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.6]
[[oss-security] 20130305 Re: CVE request: Linux kernel: xfs: _xfs_buf_find NULL pointer dereference]
[USN-1968-1]
[USN-1969-1]
[USN-1970-1]
[USN-1972-1]
[USN-1973-1]
[USN-1975-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=918009]
[https://github.com/torvalds/linux/commit/eb178619f930fa2ba2348de332a1ff1c66a31424]
lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.
Per: http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/
"Affected versions
All ruby 1.9 versions prior to ruby 1.9.3 patchlevel 392
All ruby 2.0 versions prior to ruby 2.0.0 patchlevel 0
prior to trunk revision 39384"
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702525]
[SUSE-SU-2013:0609]
[SUSE-SU-2013:0647]
[openSUSE-SU-2013:0603]
[openSUSE-SU-2013:0614]
[RHSA-2013:0611]
[RHSA-2013:0612]
[RHSA-2013:1028]
[RHSA-2013:1147]
[http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=39384]
[DSA-2738]
[DSA-2809]
[MDVSA-2013:124]
[[oss-security] 20130306 CVE for Ruby Entity expansion DoS vulnerability in REXML (XML bomb)]
[http://www.oracle.com/technetwork/topics/security/bulletinjul2015-2511963.html]
[http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/]
[58141]
[SSA:2013-075-01]
[USN-1780-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=914716]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0092]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud 4.5.x before 4.5.8 allow remote authenticated users with administrator privileges to inject arbitrary web script or HTML via the (1) quota parameter to /core/settings/ajax/setquota.php, or remote authenticated users with group admin privileges to inject arbitrary web script or HTML via the (2) group field to settings.php or (3) "share with" field.
[http://owncloud.org/about/security/advisories/oC-SA-2013-008/]
Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.
[RHSA-2013:0686]
[https://bugzilla.redhat.com/show_bug.cgi?id=918784]
The SOAP parser in PHP before 5.3.22 and 5.4.x before 5.4.12 allows remote attackers to read arbitrary files via a SOAP WSDL file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue in the soap_xmlParseFile and soap_xmlParseMemory functions.
[http://git.php.net/?p=php-src.git;a=commit;h=188c196d4da60bdde9190d2fc532650d17f7af2d]
[http://git.php.net/?p=php-src.git;a=commit;h=afe98b7829d50806559acac9b530acb8283c3bf4]
[APPLE-SA-2013-09-12-1]
[http://people.canonical.com/~ubuntu-security/cve/2013/CVE-2013-1824.html]
[http://support.apple.com/kb/HT5880]
[https://bugzilla.redhat.com/show_bug.cgi?id=918187]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2546, CVE-2013-2547, CVE-2013-2548. Reason: This candidate is a duplicate of CVE-2013-2546, CVE-2013-2547, and CVE-2013-2548. Notes: All CVE users should reference one or more of CVE-2013-2546, CVE-2013-2547, and CVE-2013-2548 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
Per https://bugzilla.redhat.com/show_bug.cgi?id=919384
"This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6. Future kernel updates for Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 6 may address this issue."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=864745d291b5ba80ea0bd0edcbe67273de368836]
[RHSA-2013:0744]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.7]
[[oss-security] 20130307 Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs]
[USN-1829-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=919384]
[https://github.com/torvalds/linux/commit/864745d291b5ba80ea0bd0edcbe67273de368836]
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=276bdb82dedb290511467a5a4fdbe9f0b52dce6f]
[RHSA-2013:0744]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.4]
[[oss-security] 20130307 Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs]
[https://bugzilla.redhat.com/show_bug.cgi?id=919164]
[https://github.com/torvalds/linux/commit/276bdb82dedb290511467a5a4fdbe9f0b52dce6f]
The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=726bc6b092da4c093eb74d13c07184b18c1af0f1]
[http://grsecurity.net/~spender/sctp.c]
[http://twitter.com/grsecurity/statuses/309805924749541376]
[24747]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4]
[[oss-security] 20130307 Re: CVE Request -- Linux kernel: sctp: SCTP_GET_ASSOC_STATS stack overflow]
[https://bugzilla.redhat.com/show_bug.cgi?id=919315]
[https://github.com/torvalds/linux/commit/726bc6b092da4c093eb74d13c07184b18c1af0f1]
calendar/managesubscriptions.php in Moodle 2.4.x before 2.4.2 does not consider capability requirements before displaying calendar subscriptions, which allows remote authenticated users to obtain potentially sensitive information by leveraging the student role.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37338]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225339]
user/view.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not enforce the forceloginforprofiles setting, which allows remote attackers to obtain sensitive course-profile information by leveraging the guest role, as demonstrated by a Google search.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37481]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225341]
lib/setuplib.php in Moodle through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote attackers to obtain sensitive information via an invalid request, which reveals the absolute path in an exception message.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36901]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225342]
repository/webdav/lib.php in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 includes the WebDAV password in the configuration form, which allows remote authenticated administrators to obtain sensitive information by configuring an instance.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37681]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225343]
Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37507]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225344]
notes/edit.php in Moodle 1.9.x through 1.9.19, 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated users to reassign notes via a modified (1) userid or (2) courseid field.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37411]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225346]
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allows remote authenticated administrators to obtain sensitive information from the external repositories of arbitrary users by leveraging the login_as feature.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36426]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225347]
Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 does not properly manage privileges for WebDAV repositories, which allows remote authenticated users to read, modify, or delete arbitrary site-wide repositories by leveraging certain read access.
[http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-37852]
[FEDORA-2013-4404]
[FEDORA-2013-4387]
[[oss-security] 20130325 Moodle security notifications public]
[https://moodle.org/mod/forum/discuss.php?d=225348]
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.
Per http://www.ubuntu.com/usn/usn-1771-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10"
[RHSA-2013:0709]
[USN-1771-1]
[[oss-security] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)]
[58492]
[https://bugs.launchpad.net/nova/+bug/1125468]
[https://bugzilla.redhat.com/show_bug.cgi?id=919648]
[nova-fixedips-dos(82877)]
[[openstack] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)]
[https://review.openstack.org/#/c/24451/]
[https://review.openstack.org/#/c/24452/]
[https://review.openstack.org/#/c/24453/]
The strHdrAcptLangGetItem function in errorpage.cc in Squid 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a "," character in an Accept-Language header.
[20130305 Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc]
[20130307 Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc]
[[oss-security] 20130311 Re: Squid 3.2.7 DoS (loop, 100% cpu) strHdrAcptLangGetItem() at errorpage.cc]
[58316]
[http://www.squid-cache.org/Advisories/SQUID-2013_1.txt]
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.
[RHSA-2013:0707]
[[oss-security] 20130314 [OSSA 2013-007] Backend credentials leak in Glance v1 API (CVE-2013-1840)]
[58490]
[USN-1764-1]
[https://bugs.launchpad.net/glance/+bug/1135541]
[openstack-glance-api-info-disclosure(82878)]
[https://review.openstack.org/#/c/24437/]
[https://review.openstack.org/#/c/24438/]
[https://review.openstack.org/#/c/24439/]
Net-Server, when the reverse-lookups option is enabled, does not check if the hostname resolves to the source IP address, which might allow remote attackers to bypass ACL restrictions via the hostname parameter.
[[oss-security] 20130304 Reverse lookup issue in Net::Server]
[[oss-security] 20130311 Re: Reverse lookup issue in Net::Server]
[58309]
[https://bugzilla.redhat.com/show_bug.cgi?id=920683]
[netserver-cve20131841-security-bypass(82900)]
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, related to "the Query Object Model and relation values."
[openSUSE-SU-2013:0510]
[http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/]
[DSA-2646]
[[oss-security] 20130311 Re: CVE Request: typo3 sql injection and open redirection]
[58330]
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
[openSUSE-SU-2013:0510]
[http://typo3.org/support/teamssecuritysecurity-bulletins/security-bulletins-single-view/article/sql-injection-and-open-redirection-in-typo3-core/]
[DSA-2646]
[[oss-security] 20130311 Re: CVE Request: typo3 sql injection and open redirection]
[58330]
Cross-site scripting (XSS) vulnerability in Piwik before 1.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://piwik.org/blog/2013/03/piwik-1-11/]
[[oss-security] 20130311 Re: CVE request: XSS in piwik 1.11]
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html
"Affected Products:
openSUSE 12.3
openSUSE 12.2
openSUSE 12.1"
[openSUSE-SU-2013:0687]
[openSUSE-SU-2013:0932]
[[subversion-announce] 20130404 Apache Subversion 1.7.9 released]
[[subversion-announce] 20130404 Subversion 1.6.21 released]
[RHSA-2013:0737]
[http://subversion.apache.org/security/CVE-2013-1845-advisory.txt]
[MDVSA-2013:153]
[USN-1893-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=929082]
[oval:org.mitre.oval:def:18973]
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.
Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html
"Affected Products:
openSUSE 12.3
openSUSE 12.2
openSUSE 12.1"
[openSUSE-SU-2013:0687]
[openSUSE-SU-2013:0932]
[[subversion-announce] 20130404 Apache Subversion 1.7.9 released]
[[subversion-announce] 20130404 Subversion 1.6.21 released]
[RHSA-2013:0737]
[http://subversion.apache.org/security/CVE-2013-1846-advisory.txt]
[MDVSA-2013:153]
[USN-1893-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=929087]
[oval:org.mitre.oval:def:18087]
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[openSUSE-SU-2013:0687]
[openSUSE-SU-2013:0932]
[[subversion-announce] 20130404 Apache Subversion 1.7.9 released]
[[subversion-announce] 20130404 Subversion 1.6.21 released]
[RHSA-2013:0737]
[http://subversion.apache.org/security/CVE-2013-1847-advisory.txt]
[MDVSA-2013:153]
[USN-1893-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=929090]
[oval:org.mitre.oval:def:18538]
fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8d0c2d10dd72c5292eda7a06231056a4c972e4cc]
[openSUSE-SU-2013:0925]
[RHSA-2013:0928]
[RHSA-2013:1026]
[RHSA-2013:1051]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4]
[MDVSA-2013:176]
[[oss-security] 20130320 CVE-2013-1848 -- Linux kernel: ext3: format string issues]
[USN-1809-1]
[USN-1811-1]
[USN-1812-1]
[USN-1813-1]
[USN-1814-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=920783]
[https://github.com/torvalds/linux/commit/8d0c2d10dd72c5292eda7a06231056a4c972e4cc]
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.
Per: http://cwe.mitre.org/data/definitions/476.html
'CWE-476: NULL Pointer Dereference'
[openSUSE-SU-2013:0687]
[openSUSE-SU-2013:0932]
[[subversion-announce] 20130404 Apache Subversion 1.7.9 released]
[[subversion-announce] 20130404 Subversion 1.6.21 released]
[RHSA-2013:0737]
[20130305 Apache Subversion mod_dav_svn DoS via MKACTIVITY/PROPFIND]
[http://subversion.apache.org/security/CVE-2013-1849-advisory.txt]
[MDVSA-2013:153]
[USN-1893-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=929093]
[oval:org.mitre.oval:def:18980]
Multiple incomplete blacklist vulnerabilities in (1) import.php and (2) ajax/uploadimport.php in apps/contacts/ in ownCloud before 4.0.13 and 4.5.x before 4.5.8 allow remote authenticated users to execute arbitrary PHP code by uploading a .htaccess file.
[http://owncloud.org/about/security/advisories/oC-SA-2013-009/]
Incomplete blacklist vulnerability in lib/migrate.php in ownCloud before 4.0.13 and 4.5.x before 4.5.8, when the user_migrate application is enabled, allows remote authenticated users to import arbitrary files to the user's account via unspecified vectors.
Per: https://cwe.mitre.org/data/definitions/184.html
"CWE-184: Incomplete Blacklist"
[http://owncloud.org/about/security/advisories/oC-SA-2013-010/]
SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
[http://packetstormsecurity.com/files/120817/WordPress-LeagueManager-3.8-SQL-Injection.html]
[http://wordpress.org/plugins/leaguemanager/changelog]
[24789]
Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database.
[http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702905]
[openSUSE-SU-2014:0118]
[[oss-security] 20130313 Re: CVE request: almanah does not encrypt its database]
[https://bugzilla.gnome.org/show_bug.cgi?id=695117]
[https://bugzilla.redhat.com/show_bug.cgi?id=920848]
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-10-22-5]
[openSUSE-SU-2013:0659]
[openSUSE-SU-2013:0660]
[openSUSE-SU-2013:0664]
[openSUSE-SU-2013:0667]
[openSUSE-SU-2013:0668]
[RHSA-2013:0699]
[RHSA-2014:1863]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/]
[[ruby-security-ann] 20130318 [CVE-2013-1854] Symbol DoS vulnerability in Active Record]
The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-10-22-5]
[openSUSE-SU-2013:0661]
[openSUSE-SU-2013:0662]
[openSUSE-SU-2014:0019]
[RHSA-2013:0698]
[RHSA-2014:1863]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/]
[[rubyonrails-security] 20130318 [CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack]
The ActiveSupport::XmlMini_JDOM backend in lib/active_support/xml_mini/jdom.rb in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-10-22-5]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/]
[[rubyonrails-security] 20130318 [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users]
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
[APPLE-SA-2013-06-04-1]
[APPLE-SA-2013-10-22-5]
[openSUSE-SU-2013:0661]
[openSUSE-SU-2013:0662]
[openSUSE-SU-2014:0019]
[RHSA-2013:0698]
[RHSA-2014:1863]
[http://support.apple.com/kb/HT5784]
[http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/]
[[rubyonrails-security] 20130318 [CVE-2013-1857] XSS Vulnerability in the `sanitize` helper of Ruby on Rails]
The clone system-call implementation in the Linux kernel before 3.8.3 does not properly handle a combination of the CLONE_NEWUSER and CLONE_FS flags, which allows local users to gain privileges by calling chroot and leveraging the sharing of the / directory between a parent process and a child process.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e66eded8309ebf679d3d3c1f5820d1f2ca332c71]
[http://stealth.openwall.net/xSports/clown-newuser.c]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3]
[[oss-security] 20130314 Re: CLONE_NEWUSER|CLONE_FS root exploit]
[https://bugzilla.redhat.com/show_bug.cgi?id=921448]
[https://github.com/torvalds/linux/commit/e66eded8309ebf679d3d3c1f5820d1f2ca332c71]
The Node Parameter Control module 6.x-1.x for Drupal does not properly restrict access to the configuration options, which allows remote attackers to read and edit configuration options via unspecified vectors.
[http://drupal.org/node/1942330]
[http://packetstormsecurity.com/files/120788/Drupal-Node-Parameter-Control-6.x-Access-Bypass.html]
[20130313 [Security-news] SA-CONTRIB-2013-034 - Node Parameter Control - Access Bypass]
[[oss-security] 20130314 Re: CVE request for a Drupal contributed module]
Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c0f5ecee4e741667b2493c742b60b6218d40b3aa]
[RHSA-2014:0328]
[RHSA-2014:0339]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.4]
[MDVSA-2013:176]
[[oss-security] 20130314 Re: CVE Request/Guidance: Linux kernel cdc-wdm buffer overflow triggered by device]
[58510]
[USN-1809-1]
[USN-1811-1]
[USN-1812-1]
[USN-1813-1]
[USN-1814-1]
[USN-1829-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=921970]
[https://github.com/torvalds/linux/commit/c0f5ecee4e741667b2493c742b60b6218d40b3aa]
MariaDB 5.5.x before 5.5.30, 5.3.x before 5.3.13, 5.2.x before 5.2.15, and 5.1.x before 5.1.68, and Oracle MySQL 5.1.69 and earlier, 5.5.31 and earlier, and 5.6.11 and earlier allows remote attackers to cause a denial of service (crash) via a crafted geometry feature that specifies a large number of points, which is not properly handled when processing the binary representation of this feature, related to a numeric calculation error.
Per https://access.redhat.com/security/cve/CVE-2013-1861
"This issue affects the version of mysql as shipped with Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw."
[[Commits] 20130305 Rev 3682: TODO-424 geometry query crashes server. in file:///home/hf/wmar/todo-424/]
[SUSE-SU-2013:1390]
[SUSE-SU-2013:1529]
[openSUSE-SU-2013:1335]
[openSUSE-SU-2013:1410]
[[oss-security] 20130513 CVE-2013-1861 for MySQL/MariaDB: geometry query crashes mysqld]
[GLSA-201409-04]
[DSA-2818]
[http://www.oracle.com/technetwork/topics/security/cpujuly2013-1899826.html]
[58511]
[USN-1909-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=919247]
[mysql-mariadb-cve20131861-dos(82895)]
[https://mariadb.atlassian.net/browse/MDEV-4252]
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.
[openSUSE-SU-2013:1337]
[openSUSE-SU-2013:1340]
[openSUSE-SU-2013:1341]
[http://people.apache.org/~jorton/mod_rewrite-CVE-2013-1862.patch]
[RHSA-2013:0815]
[RHSA-2013:1207]
[RHSA-2013:1208]
[RHSA-2013:1209]
[http://support.apple.com/kb/HT6150]
[http://svn.apache.org/viewvc?view=revision&revision=r1469311]
[20130822 Apache HTTP Server mod_rewrite Log File Manipulation Vulnerability]
[http://www.fujitsu.com/global/support/software/security/products-f/interstage-201303e.html]
[MDVSA-2013:174]
[http://www.oracle.com/technetwork/topics/security/cpujan2014-1972949.html]
[59826]
[64758]
[USN-1903-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644047]
[https://bugzilla.redhat.com/show_bug.cgi?id=953729]
[SSRT101288]
[[httpd-cvs] 20190815 svn commit: r1048742 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [2/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:18790]
[oval:org.mitre.oval:def:19534]
Samba 4.x before 4.0.4, when configured as an Active Directory domain controller, uses world-writable permissions on non-default CIFS shares, which allows remote authenticated users to read, modify, create, or delete arbitrary files via standard filesystem operations.
[http://www.samba.org/samba/ftp/patches/security/samba-4.0.3-CVE-2013-1863.patch]
[http://www.samba.org/samba/security/CVE-2013-1863]
The Portable Tool Library (aka PTLib) before 2.10.10, as used in Ekiga before 4.0.1, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted PXML document containing a large number of nested entity references, aka a "billion laughs attack."
[FEDORA-2013-2998]
[[oss-security] 20130315 Re: CVE request: billion laughs flaw in ptlib]
[http://sourceforge.net/p/opalvoip/code/28856]
[http://www.ekiga.org/news/2013-02-21/ekiga-4.0.1-stable-available]
[58520]
[ptlib-xml-dos(82885)]
[SUSE-SU-2014:0237]
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
Per http://www.ubuntu.com/usn/USN-1772-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10"
[FEDORA-2013-4590]
[openSUSE-SU-2013:0565]
[RHSA-2013:0708]
[[oss-security] 20130320 [OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865)]
[58616]
[USN-1772-1]
[https://bugs.launchpad.net/keystone/+bug/1129713]
[https://review.openstack.org/#/c/24906/]
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.
[[oss-security] 20130319 Re: CVE Request: VLC Buffer overflows]
[57079]
[http://www.videolan.org/security/sa1301.html]
[oval:org.mitre.oval:def:17226]
CRLF injection vulnerability in spacewalk-java before 2.1.148-1 and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary HTTP headers, and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks, via the return_url parameter.
[RHSA-2014:0148]
[https://bugzilla.redhat.com/show_bug.cgi?id=923464]
[https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f]
[SUSE-SU-2014:0222]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-1869. Reason: This candidate is a reservation duplicate of CVE-2013-1869. Notes: All CVE users should reference CVE-2013-1869 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Cross-site scripting (XSS) vulnerability in account/EditAddress.do in Spacewalk and Red Hat Network (RHN) Satellite 5.6 allows remote attackers to inject arbitrary web script or HTML via the type parameter.
[RHSA-2014:0148]
[https://bugzilla.redhat.com/show_bug.cgi?id=923467]
[https://git.fedorahosted.org/cgit/spacewalk.git/commit/?id=18c70164285cae0660fa3ac55c6656bb19b3b13f]
[SUSE-SU-2014:0222]
The Intel drivers in Mesa 8.0.x and 9.0.x allow context-dependent attackers to cause a denial of service (reachable assertion and crash) and possibly execute arbitrary code via vectors involving 3d graphics that trigger an out-of-bounds array access, related to the fs_visitor::remove_dead_constants function. NOTE: this issue might be related to CVE-2013-0796.
[http://advisories.mageia.org/MGASA-2013-0190.html]
[SUSE-SU-2013:1175]
[openSUSE-SU-2013:1188]
[RHSA-2013:0897]
[DSA-2704]
[60285]
[USN-1888-1]
[https://bugs.freedesktop.org/show_bug.cgi?id=59429]
[https://bugzilla.redhat.com/show_bug.cgi?id=923584]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2634, CVE-2013-2635, CVE-2013-2636. Reason: This candidate is a duplicate of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636. Notes: All CVE users should reference one or more of CVE-2013-2634, CVE-2013-2635, and CVE-2013-2636 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.
<a href = http://cwe.mitre.org/data/definitions/426.html> CWE-426: Untrusted Search Path </a>
[http://code.call-cc.org/cgi-bin/gitweb.cgi?p=chicken-core.git;a=blob;f=NEWS;h=c21c7cf9d1faf4f78736890ac7ca1d4b82d72ddd;hb=c6750af99ada7fa4815ee834e4e705bcfac9c137]
[[oss-security] 20130319 Untrusted startup file inclusion in Chicken Scheme]
[58583]
[chicken-cve20131874-csirc-code-execution(85065)]
command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename.
[http://packetstormsecurity.com/files/120847/Ruby-Gem-Command-Wrap-Command-Execution.html]
[20130318 Remote command execution in Ruby Gem Command Wrap]
[[oss-security] 20130319 Fwd: CVE requests]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2615. Reason: This candidate is a duplicate of CVE-2013-2615. Notes: All CVE users should reference CVE-2013-2615 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2616. Reason: This candidate is a duplicate of CVE-2013-2616. Notes: All CVE users should reference CVE-2013-2616 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2617. Reason: This candidate is a duplicate of CVE-2013-2617. Notes: All CVE users should reference CVE-2013-2617 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."
[RHSA-2013:1029]
[61142]
[activemq-cve20131879-xss(85586)]
[https://issues.apache.org/jira/browse/AMQ-4397]
Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
[RHSA-2013:1029]
[65615]
[https://bugzilla.redhat.com/show_bug.cgi?id=924447]
[https://issues.apache.org/jira/browse/AMQ-4398]
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
[http://en.securitylab.ru/lab/PT-2013-01]
[http://ftp.gnome.org/pub/GNOME/sources/librsvg/2.39/librsvg-2.39.0.changes]
[SUSE-SU-2015:1785]
[openSUSE-SU-2013:1786]
[RHSA-2014:0127]
[USN-2149-1]
[USN-2149-2]
[https://bugzilla.gnome.org/show_bug.cgi?id=691708]
Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type.
[http://www.mantisbt.org/bugs/view.php?id=15573]
[[oss-security] 20130322 Re: CVE request: MantisBT text search query can crash site]
[58626]
[https://bugzilla.redhat.com/show_bug.cgi?id=924340]
[mantisbt-filterapi-dos(83347)]
[https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7]
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.html
"Affected Products:
openSUSE 12.3
openSUSE 12.2
openSUSE 12.1"
[openSUSE-SU-2013:0687]
[[subversion-announce] 20130404 Apache Subversion 1.7.9 released]
[http://subversion.apache.org/security/CVE-2013-1884-advisory.txt]
[MDVSA-2013:153]
[USN-1893-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=929095]
[oval:org.mitre.oval:def:18788]
Multiple cross-site scripting (XSS) vulnerabilities in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) tus/ or (2) tus/tus/.
[RHSA-2013:0856]
[1029685]
[https://bugzilla.redhat.com/show_bug.cgi?id=923039]
[rhcs-cve20131885-xss(84477)]
Format string vulnerability in the token processing system (pki-tps) in Red Hat Certificate System (RHCS) 8.1 and possibly Dogtag Certificate System 9 and 10 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to viewing certificates.
[RHSA-2013:0856]
[60085]
[1029685]
[https://bugzilla.redhat.com/show_bug.cgi?id=924870]
Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.
[http://drupal.org/node/1948354]
[http://drupal.org/node/1948358]
[http://drupalcode.org/project/views.git/commitdiff/ddf8181bd13f69ffbeeee14ae72168418785d7ac]
[http://packetstormsecurity.com/files/120892/Drupal-Views-7.x-Cross-Site-Scripting.html]
[20130320 [Security-news] SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)]
[[oss-security] 20130322 Re: CVE Request -- drupal7-views : SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)]
[[oss-security] 20130325 Re: CVE Request -- drupal7-views : SA-CONTRIB-2013-035 - Views - Cross Site Scripting (XSS)]
[58621]
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
[FEDORA-2013-8193]
[FEDORA-2013-8221]
[FEDORA-2013-8166]
[[oss-security] 20130322 Re: CVE Request: python-pip insecure temporary directory handling]
[https://github.com/pypa/pip/issues/725]
[https://github.com/pypa/pip/pull/734/files]
[https://github.com/pypa/pip/pull/780/files]
Multiple cross-site scripting (XSS) vulnerabilities in ownCloud Server before 5.0.1 allow remote attackers to inject arbitrary web script or HTML via the (1) new_name parameter to apps/bookmarks/ajax/renameTag.php or (2) multiple unspecified parameters to unknown files in apps/contacts/ajax/.
[http://owncloud.org/about/security/advisories/oC-SA-2013-011]
[58852]
[owncloud-cve20131890-multiple-xss(83245)]
MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMonkey, which allows remote authenticated users to cause a denial of service (invalid memory access and server crash) or execute arbitrary code via a crafted memory address in the first argument.
[http://blog.scrt.ch/2013/03/24/mongodb-0-day-ssji-to-rce/]
[FEDORA-2013-4539]
[FEDORA-2013-4531]
[RHSA-2013:1170]
[24935]
[24947]
[http://www.mongodb.org/about/alerts/]
[[oss-security] 20130325 Re: CVE Request: Mongo DB]
[https://jira.mongodb.org/browse/SERVER-9124]
SQL injection vulnerability in addressbookprovider.php in ownCloud Server before 5.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to the contacts application.
[http://owncloud.org/about/security/advisories/oC-SA-2013-012]
[58855]
[owncloud-addressbookprovider-sql-injection(83253)]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2013-2561. Reason: This candidate is a duplicate of CVE-2013-2561. Notes: All CVE users should reference CVE-2013-2561 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.
[openSUSE-SU-2013:1337]
[openSUSE-SU-2013:1340]
[openSUSE-SU-2013:1341]
[RHSA-2013:1156]
[RHSA-2013:1207]
[RHSA-2013:1208]
[RHSA-2013:1209]
[http://support.apple.com/kb/HT6150]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?r1=1482522&r2=1485668&diff_format=h]
[http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/dav/main/mod_dav.c?view=log]
[20130822 Apache HTTP Server MERGE Request Denial of Service Vulnerability]
[http://www.apache.org/dist/httpd/Announcement2.2.html]
[61129]
[USN-1903-1]
[http://www-01.ibm.com/support/docview.wss?uid=swg21644047]
[SSRT101288]
[https://httpd.apache.org/security/vulnerabilities_24.html]
[[httpd-cvs] 20190815 svn commit: r1048743 [4/4] - in /websites/staging/httpd/trunk/content: ./ security/vulnerabilities-httpd.xml security/vulnerabilities_13.html security/vulnerabilities_20.html security/vulnerabilities_22.html security/vulnerabilities_24.html]
[oval:org.mitre.oval:def:18835]
[oval:org.mitre.oval:def:19747]
The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.
[FEDORA-2013-4578]
[RHSA-2013:0742]
[https://bugzilla.redhat.com/show_bug.cgi?id=928105]
[https://fedorahosted.org/389/ticket/47308]
[https://fedorahosted.org/freeipa/ticket/3540]
[https://git.fedorahosted.org/cgit/389/ds.git/commit/?h=389-ds-base-1.2.11&id=5a18c828533a670e7143327893f8171a19062286]
lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
[20130326 Ruby gem Thumbshooter 0.1.5 remote command execution]
[http://vapid.dhs.org/advisories/thumbshooter-ruby-gem-remoteexec.html]
[[oss-security] 20130326 Re: Ruby gem Thumbshooter 0.1.5 remote code execution]
[[oss-security] 20130326 Ruby gem Thumbshooter 0.1.5 remote code execution]
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
Per http://www.ubuntu.com/usn/USN-1789-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
Ubuntu 8.04 LTS"
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-17-1]
[FEDORA-2013-5000]
[FEDORA-2013-6148]
[openSUSE-SU-2013:0627]
[openSUSE-SU-2013:0628]
[SUSE-SU-2013:0633]
[openSUSE-SU-2013:0635]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5892]
[DSA-2658]
[MDVSA-2013:142]
[http://www.postgresql.org/about/news/1456/]
[http://www.postgresql.org/docs/current/static/release-9-0-13.html]
[http://www.postgresql.org/docs/current/static/release-9-1-9.html]
[http://www.postgresql.org/docs/current/static/release-9-2-4.html]
[http://www.postgresql.org/support/security/faq/2013-04-04/]
[USN-1789-1]
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
Per http://www.ubuntu.com/usn/USN-1789-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
Ubuntu 8.04 LTS"
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-17-1]
[FEDORA-2013-5000]
[FEDORA-2013-6148]
[openSUSE-SU-2013:0627]
[openSUSE-SU-2013:0628]
[SUSE-SU-2013:0633]
[openSUSE-SU-2013:0635]
[RHSA-2013:1475]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5892]
[DSA-2657]
[DSA-2658]
[MDVSA-2013:142]
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1456/]
[http://www.postgresql.org/docs/current/static/release-8-4-17.html]
[http://www.postgresql.org/docs/current/static/release-9-0-13.html]
[http://www.postgresql.org/docs/current/static/release-9-1-9.html]
[http://www.postgresql.org/docs/current/static/release-9-2-4.html]
[USN-1789-1]
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
Per http://www.ubuntu.com/usn/USN-1789-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
Ubuntu 8.04 LTS"
[APPLE-SA-2013-09-12-1]
[APPLE-SA-2013-09-17-1]
[FEDORA-2013-5000]
[FEDORA-2013-6148]
[openSUSE-SU-2013:0627]
[openSUSE-SU-2013:0628]
[SUSE-SU-2013:0633]
[openSUSE-SU-2013:0635]
[http://support.apple.com/kb/HT5880]
[http://support.apple.com/kb/HT5892]
[DSA-2658]
[MDVSA-2013:142]
[http://www.postgresql.org/about/news/1456/]
[http://www.postgresql.org/docs/current/static/release-9-1-9.html]
[http://www.postgresql.org/docs/current/static/release-9-2-4.html]
[USN-1789-1]
PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable filenames, which has unspecified impact and attack vectors related to "graphical installers for Linux and Mac OS X."
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1456/]
[http://www.postgresql.org/support/security/]
PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.
[http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html]
[http://www.postgresql.org/about/news/1456/]
[http://www.postgresql.org/support/security/]
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.
[http://habrahabr.ru/post/174423/]
[openSUSE-SU-2013:0671]
[[dev] 20130327 [RCD] zero day vulnerability (tested on v8.0 to 9.0)]
[http://sourceforge.net/p/roundcubemail/news/2013/03/security-updates-086-and-073/]
[[oss-security] 20130328 Re: CVE Request -- roundcubemail: Local file inclusion via web UI modification of certain config options]
Cross-site scripting (XSS) vulnerability in the Zero Point theme 7.x-1.x before 7.x-1.9 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://drupal.org/node/1954588]
[http://packetstormsecurity.com/files/120985/Drupal-Zero-Point-7.x-Cross-Site-Scripting.html]
[20130327 [Security-news] SA-CONTRIB-2013-036 - Zero Point - Cross Site Scripting (XSS)]
[58758]
[https://drupal.org/node/1953840]
[zeropoint-unspecified-xss(83137)]
Cross-site scripting (XSS) vulnerability in the Rules module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with the "administer rules" permission to inject arbitrary web script or HTML via a rule tag.
[https://drupal.org/node/1954508]
[https://drupal.org/node/1954592]
The Commons Group module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
[http://packetstormsecurity.com/files/120991/Drupal-Common-Groups-7.x-Access-Bypass-Privilege-Escalation.html]
[20130327 [Security-news] SA-CONTRIB-2013-038 - Commons Groups - Access bypass & Privilege escalation]
[https://drupal.org/node/1954762]
[https://drupal.org/node/1954764]
[https://drupal.org/node/1954948]
[drupal-commons-groups-security-bypass(83133)]
The Commons Wikis module before 7.x-3.1 for Drupal, as used in the Commons module before 7.x-3.1, does not properly restrict access to groups, which allows remote attackers to post arbitrary content to groups via unspecified vectors.
[http://packetstormsecurity.com/files/120995/Drupal-Common-Wikis-7.x-Access-Bypass-Privilege-Escalation.html]
[20130327 [Security-news] SA-CONTRIB-2013-039 - Commons Wikis - Access bypass & Privilege escalation]
[https://drupal.org/node/1954766]
[https://drupal.org/node/1954768]
[https://drupal.org/node/1954948]
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
[http://qpid.apache.org/releases/qpid-0.22/release-notes.html]
[RHSA-2013:1024]
[http://svn.apache.org/viewvc?view=revision&revision=1460013]
[https://issues.apache.org/jira/browse/QPID-4918]
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
[20130401 Remote command execution in Ruby Gem ldoce 0.0.2]
[http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html]
[[oss-security] 20130331 Re: Remote command execution in Ruby Gem ldoce 0.0.2]
[58783]
[rubygem-cve20131911-command-exec(83163)]
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.
[FEDORA-2013-4807]
[FEDORA-2013-4827]
[FEDORA-2013-6253]
[RHSA-2013:0729]
[RHSA-2013:0868]
[DSA-2711]
[[oss-security] 20130403 CVE-2013-1912 : haproxy may crash on TCP content inspection rules]
[58820]
[USN-1800-1]
Integer overflow in the load_image function in file-xwd.c in the X Window Dump (XWD) plug-in in GIMP 2.6.9 and earlier, when used with glib before 2.24, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large color entries value in an X Window System (XWD) image dump.
[RHSA-2013:1778]
[DSA-2813]
[64105]
[USN-2051-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=947868]
[GLSA-201603-01]
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.
[RHSA-2013:0769]
[RHSA-2013:1605]
[http://sourceware.org/bugzilla/show_bug.cgi?id=15330]
[http://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1cef1b19089528db11f221e938f60b9b048945d7]
[MDVSA-2013:163]
[MDVSA-2013:283]
[MDVSA-2013:284]
[[oss-security] 20130403 CVE Request: glibc getaddrinfo() stack overflow]
[[oss-security] 20130403 Re: CVE Request: glibc getaddrinfo() stack overflow]
[[oss-security] 20130405 Re: CVE Request: glibc getaddrinfo() stack overflow]
[58839]
[USN-1991-1]
[http://www.vmware.com/security/advisories/VMSA-2014-0008.html]
[https://bugzilla.novell.com/show_bug.cgi?id=813121]
[https://bugzilla.redhat.com/show_bug.cgi?id=947882]
[GLSA-201503-04]
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.
[FEDORA-2013-4834]
[FEDORA-2013-4831]
[FEDORA-2013-4908]
[openSUSE-SU-2013:1331]
[openSUSE-SU-2013:1336]
[openSUSE-SU-2013:1342]
[DSA-2659]
[MDVSA-2013:156]
[[oss-security] 20130403 Re: CVE Request -- ModSecurity (X < 2.7.3): Vulnerable to XXE attacks]
[58810]
[https://bugzilla.redhat.com/show_bug.cgi?id=947842]
[https://github.com/SpiderLabs/ModSecurity/blob/master/CHANGES]
[https://github.com/SpiderLabs/ModSecurity/commit/d4d80b38aa85eccb26e3c61b04d16e8ca5de76fe]
Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.
[FEDORA-2013-6723]
[SUSE-SU-2014:0411]
[SUSE-SU-2014:0446]
[SUSE-SU-2014:0470]
[openSUSE-SU-2013:0912]
[GLSA-201309-24]
[DSA-2662]
[[oss-security] 20130418 Xen Security Advisory 44 (CVE-2013-1917) - Xen PV DoS vulnerability with SYSENTER]
[1028455]
Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."
[FEDORA-2013-7432]
[SUSE-SU-2014:0446]
[GLSA-201309-24]
[DSA-2666]
[[oss-security] 20130502 Xen Security Advisory 45 (CVE-2013-1918) - Several long latency operations are not preemptible]
[59615]
Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."
[FEDORA-2013-6723]
[FEDORA-2013-6641]
[SUSE-SU-2014:0446]
[openSUSE-SU-2013:0912]
[GLSA-201309-24]
[DSA-2662]
[[oss-security] 20130418 Xen Security Advisory 46 (CVE-2013-1919) - Several access permission issues with IRQs for unprivileged guests]
[59292]
Xen 4.2.x, 4.1.x, and earlier, when the hypervisor is running "under memory pressure" and the Xen Security Module (XSM) is enabled, uses the wrong ordering of operations when extending the per-domain event channel tracking table, which causes a use-after-free and allows local guest kernels to inject arbitrary events and gain privileges via unspecified vectors.
[SUSE-SU-2014:0411]
[SUSE-SU-2014:0446]
[SUSE-SU-2014:0470]
[openSUSE-SU-2013:0912]
[[Xen-announce] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations]
[GLSA-201309-24]
[[oss-security] 20130404 Xen Security Advisory 47 (CVE-2013-1920) - Potential use of freed memory in event channel operations]
[58880]
[1028388]
[xen-cve20131920-code-exec(83226)]
PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file.
[RHSA-2013:1207]
[RHSA-2013:1208]
[RHSA-2013:1209]
[RHSA-2013:1437]
[RHSA-2014:0029]
[https://bugzilla.redhat.com/show_bug.cgi?id=948106]
qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.
[FEDORA-2013-6185]
[FEDORA-2013-6221]
[FEDORA-2013-6211]
[GLSA-201309-24]
[[oss-security] 20130415 Xen Security Advisory 48 (CVE-2013-1922) - qemu-nbd format-guessing due to missing format specification]
[[oss-security] 20130416 CVE-2013-1922 -- qemu: qemu-nbd block format auto-detection vulnerability]
[1028426]
rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.
[openSUSE-SU-2013:1012]
[openSUSE-SU-2013:1016]
[openSUSE-SU-2013:1048]
[[linux-nfs] 20130402 Re: [PATCH] Avoid PTR lookups when possible]
[[linux-nfs] 20130403 Re: [PATCH] Avoid PTR lookups when possible]
[58854]
[https://bugzilla.redhat.com/show_bug.cgi?id=948072]
[nfsutils-cve20131923-spoofing(85331)]
The Chaos Tool Suite (ctools) module 7.x-1.x before 7.x-1.3 for Drupal does not properly restrict node access, which allows remote authenticated users with the "access content" permission to read restricted node titles via an autocomplete list.
[http://packetstormsecurity.com/files/121072/Drupal-Chaos-Tool-Suite-7.x-Access-Bypass.html]
[20130403 [Security-news] SA-CONTRIB-2013-041 - Chaos tool suite (ctools) - Access bypass]
[https://drupal.org/node/1960406]
[https://drupal.org/node/1960424]
[drupal-chaostool-node-security-bypass(83254)]
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.
Per http://www.ubuntu.com/usn/USN-1804-1/ "A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS"
Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html
"Affected Products:
openSUSE 12.2"
[http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/34b6f60ae586]
[http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/25dd7c7ac39c]
[SUSE-SU-2013:0851]
[SUSE-SU-2013:1174]
[openSUSE-SU-2013:0715]
[openSUSE-SU-2013:0735]
[openSUSE-SU-2013:0826]
[openSUSE-SU-2013:0893]
[openSUSE-SU-2013:0897]
[openSUSE-SU-2013:0966]
[[distro-pkg-dev] 20130417 IcedTea-Web 1.3.2 and 1.2.3 released!]
[RHSA-2013:0753]
[MDVSA-2013:146]
[59281]
[USN-1804-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=916774]
[icedtea-cve20131940-security-bypass(83642)]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123]
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."
Per http://www.ubuntu.com/usn/USN-1804-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10 Ubuntu 10.04 LTS" Per http://lists.opensuse.org/opensuse-updates/2013-04/msg00106.html "Affected Products: openSUSE 12.2"
[http://icedtea.classpath.org/hg/release/icedtea-web-1.2/file/icedtea-web-1.2.3/NEWS]
[http://icedtea.classpath.org/hg/release/icedtea-web-1.2/rev/cb58b31c450e]
[http://icedtea.classpath.org/hg/release/icedtea-web-1.3/rev/19f5282f53e8]
[SUSE-SU-2013:0851]
[SUSE-SU-2013:1174]
[openSUSE-SU-2013:0715]
[openSUSE-SU-2013:0735]
[openSUSE-SU-2013:0826]
[openSUSE-SU-2013:0893]
[openSUSE-SU-2013:0897]
[openSUSE-SU-2013:0966]
[[distro-pkg-dev] 20130417 IcedTea-Web 1.3.2 and 1.2.3 released!]
[RHSA-2013:0753]
[MDVSA-2013:146]
[59286]
[USN-1804-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=884705]
[icedtea-cve20131927-sec-bypass(83640)]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0123]
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.
Per https://access.redhat.com/security/cve/CVE-2013-1928 "This issue affects the version of Linux kernel as shipped with Red Hat Enterprise Linux 6. Future kernel updates for Red Hat Enterprise Linux 6 may address this issue."
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=12176503366885edd542389eed3aaf94be163fdb]
[openSUSE-SU-2013:0847]
[SUSE-SU-2013:0856]
[RHSA-2013:1645]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.5]
[[oss-security] 20130405 Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE]
[[oss-security] 20130409 Re: CVE Request: kernel information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE]
[USN-1829-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=949567]
[https://github.com/torvalds/linux/commit/12176503366885edd542389eed3aaf94be163fdb]
Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.
[http://cansecwest.com/slides/2013/PrivateCore%20CSW%202013.pdf]
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=715230a44310a8cf66fbfb5a46f9a62a9b2de424]
[FEDORA-2013-5368]
[SUSE-SU-2013:1473]
[SUSE-SU-2013:1474]
[openSUSE-SU-2013:1971]
[RHSA-2013:1645]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6]
[MDVSA-2013:176]
[[oss-security] 20130405 Re: CVE Request: tg3 VPD firmware -> driver injection]
[USN-1834-1]
[USN-1835-1]
[USN-1836-1]
[USN-1838-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=949932]
[https://github.com/torvalds/linux/commit/715230a44310a8cf66fbfb5a46f9a62a9b2de424]
The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename.
[http://vapid.dhs.org/advisories/karteek-docsplit-cmd-inject.html]
[[oss-security] 20130408 Re: Remote Command Injection Ruby Gem Karteek Docsplit 0.5.4]
[karteekdocsplit-cve20131933-command-exec(83277)]
A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.
[RHSA-2013:0911]
[https://bugzilla.redhat.com/show_bug.cgi?id=949981]
[RHSA-2013:0907]
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
** DISPUTED ** Multiple cross-site scripting (XSS) vulnerabilities in tbl_gis_visualization.php in phpMyAdmin 3.5.x before 3.5.8 might allow remote attackers to inject arbitrary web script or HTML via the (1) visualizationSettings[width] or (2) visualizationSettings[height] parameter. NOTE: a third party reports that this is "not exploitable."
[20130409 [waraxe-2013-SA#102] - Reflected XSS in phpMyAdmin 3.5.7]
[http://immunityservices.blogspot.com/2019/02/cvss.html]
[FEDORA-2013-5620]
[FEDORA-2013-5623]
[FEDORA-2013-5604]
[openSUSE-SU-2013:1065]
[[oss-security] 20130409 Re: CVE Request: Self-XSS in phpmyadmin fixed in 3.5.8]
[http://packetstormsecurity.com/files/121205/phpMyAdmin-3.5.7-Cross-Site-Scripting.html]
[MDVSA-2013:144]
[http://www.phpmyadmin.net/home_page/security/PMASA-2013-1.php]
[http://www.waraxe.us/advisory-102.html]
[https://github.com/phpmyadmin/phpmyadmin/commit/79089c9bc02c82c15419fd9d6496b8781ae08a5a]
The HTML\Browser plugin in SabreDAV before 1.6.9, 1.7.x before 1.7.7, and 1.8.x before 1.8.5, as used in ownCloud, when running on Windows, does not properly check path separators in the base path, which allows remote attackers to read arbitrary files via a \ (backslash) character.
[http://owncloud.org/about/security/advisories/oC-SA-2013-016/]
[https://groups.google.com/forum/?fromgroups=#!topic/sabredav-discuss/ehOUu7wTSGQ]
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.
Per http://www.ubuntu.com/usn/USN-1803-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS"
[FEDORA-2013-5928]
[FEDORA-2013-5883]
[openSUSE-SU-2013:0878]
[DSA-2661]
[[oss-security] 20130418 Xorg-x11-server: Information disclosure due enabling events from hot-plug devices despite input from the device being momentarily disabled]
[USN-1803-1]
[https://bugs.freedesktop.org/show_bug.cgi?id=63353]
The installation routine in ownCloud Server before 4.0.14, 4.5.x before 4.5.9, and 5.0.x before 5.0.4 uses the time function to seed the generation of the PostgreSQL database user password, which makes it easier for remote attackers to guess the password via a brute force attack.
[http://owncloud.org/about/security/advisories/oC-SA-2013-015/]
Multiple cross-site scripting (XSS) vulnerabilities in actionscript/Jplayer.as in the Flash SWF component (jplayer.swf) in jPlayer before 2.2.20, as used in ownCloud Server before 5.0.4 and other products, allow remote attackers to inject arbitrary web script or HTML via the (1) jQuery or (2) id parameters, as demonstrated using document.write in the jQuery parameter, a different vulnerability than CVE-2013-2022 and CVE-2013-2023.
[[oss-security] 20130411 CVE-2013-1942 jPlayer 2.2.19 XSS]
[[oss-security] 20130429 Re: CVE-2013-1942 jPlayer 2.2.19 XSS]
[[oss-security] 20130505 Re: CVE-2013-1942 jPlayer 2.2.19 XSS]
[http://owncloud.org/about/security/advisories/oC-SA-2013-014/]
[20130421 Vulnerabilities in jPlayer]
[http://www.jplayer.org/2.3.0/release-notes/]
[59030]
[https://github.com/happyworm/jPlayer/commit/e8ca190f7f972a6a421cb95f09e138720e40ed6d]
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/paging_tmpl.h and virt/kvm/kvm_main.c.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=fa3d315a4ce2c0891cdde262562e710d95fba19e]
[http://web.archive.org/web/20130329070349/http://ftp.osuosl.org/pub/linux/kernel/v3.0/ChangeLog-3.0]
[USN-1939-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=950490]
[https://github.com/torvalds/linux/commit/fa3d315a4ce2c0891cdde262562e710d95fba19e]
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Per http://www.ubuntu.com/usn/USN-1801-1/
"A security issue affects these releases of Ubuntu and its derivatives:
Ubuntu 12.10
Ubuntu 12.04 LTS
Ubuntu 11.10
Ubuntu 10.04 LTS
Ubuntu 8.04 LTS"
[http://curl.haxx.se/docs/adv_20130412.html]
[APPLE-SA-2013-10-22-3]
[FEDORA-2013-5618]
[FEDORA-2013-5598]
[FEDORA-2013-6780]
[FEDORA-2013-6766]
[FEDORA-2013-7813]
[FEDORA-2013-7797]
[openSUSE-SU-2013:0876]
[openSUSE-SU-2013:0879]
[RHSA-2013:0771]
[DSA-2660]
[MDVSA-2013:151]
[http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html]
[59058]
[USN-1801-1]
[https://bugzilla.redhat.com/show_bug.cgi?id=950577]
[https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66]
[https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121]
The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7.x-2.x before 7.x-2.0-alpha5 for Drupal, when page caching is enabled and anonymous users are assigned RESTWS permissions, allows remote attackers to cause a denial of service via a GET request with an HTTP Accept header set to a non-HTML type, which can "interfere with Drupal's page cache."
[[oss-security] 20130412 Re: CVE request for Drupal contributed modules]
[https://drupal.org/node/1966752]
[https://drupal.org/node/1966758]
[https://drupal.org/node/1966780]
kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb.
[[oss-security] 20130410 Remote command injection in Ruby Gem kelredd-pruview 0.3.8]
[[oss-security] 20130412 Re: Remote command injection in Ruby Gem kelredd-pruview 0.3.8]
converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
[http://vapid.dhs.org/advisories/md2pdf-remote-exec.html]
[59061]
[md2pdf-cve20131948-command-exec(83416)]
Social Media Widget (social-media-widget) plugin 4.0 for WordPress contains an externally introduced modification (Trojan Horse), which allows remote attackers to force the upload of arbitrary files.
[http://blog.sucuri.net/2013/04/wordpress-plugin-social-media-widget.html]
[http://it.slashdot.org/story/13/04/13/212226/popular-wordpress-plug-in-caught-spamming-is-put-on-probation]
[http://securityledger.com/hacked-wordpress-plug-in-put-on-double-secret-probation/]
[[oss-security] 20130413 CVE-2013-1949 Social Media Widget remote file inclusion]
The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remote attackers to cause a denial of service (rpcbind crash) via a Sun RPC request with crafted arguments that trigger a free of an invalid pointer.
[http://git.infradead.org/users/steved/libtirpc.git/commitdiff/a9f437119d79a438cb12e510f3cadd4060102c9f]
[RHSA-2013:0884]
[https://bugzilla.redhat.com/show_bug.cgi?id=948378]
Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.
[FEDORA-2013-7432]
[SUSE-SU-2014:0446]
[GLSA-201309-24]
[DSA-2666]
[[oss-security] 20130502 Xen Security Advisory 49 (CVE-2013-1952) - VT-d interrupt remapping source validation flaw for bridges]
[59617]
[xen-cve20131952-dos(83968)]
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.
[MDVSA-2013:190]
[[oss-security] 20130316 Re: autotrace: stack-based buffer overflow in bmp parser]
[https://bugzilla.redhat.com/show_bug.cgi?id=951257]
The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.
[http://git.videolan.org/?p=vlc.git;a=commitdiff;h=b31ce523331aa3a6e620b68cdfe3f161d519631e]
[[oss-security] 20130414 CVE Request: VLC Buffer Overflow in ASF Demuxer]
[[oss-security] 20130416 Re: CVE Request: VLC Buffer Overflow in ASF Demuxer]
[http://trac.videolan.org/vlc/ticket/8024]
[57333]
[http://www.videolan.org/security/sa1302.html]
[oval:org.mitre.oval:def:17023]
Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
[http://docs7.easyphpcalendar.com/source/ChangeLog/changeLog.htm]
[http://www.easyphpcalendar.com/forums/showthread.php?p=4555]
[[oss-security] 20130416 Re: CVE for XSS in EasyPHPCalender script]
The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=3151527ee007b73a0ebd296010f1c0454a919c7d]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6]
[[oss-security] 20130416 Re: Re: Summary of security bugs (now fixed) in user namespaces]
[https://github.com/torvalds/linux/commit/3151527ee007b73a0ebd296010f1c0454a919c7d]
The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.
[http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=132c94e31b8bca8ea921f9f96a57d684fa4ae0a9]
[http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.6]
[[oss-security] 20130416 Re: Re: Summary of security bugs (now fixed) in user namespaces]
[https://github.com/torvalds/linux/commit/132c94e31b8bca8ea921f9f96a57]