# definitions

definition_id: oval:org.debian:def:271912665204981326114361376236699824062
title: CVE-2013-4419 libguestfs
description:
The guestfish command in libguestfs 1.20.12, 1.22.7, and earlier, when using the --remote or --listen option, does not properly check the ownership of /tmp/.guestfish-$UID/ when creating a temporary socket file in this directory, which allows local users to write to the socket and execute arbitrary commands by creating /tmp/.guestfish-$UID/ in advance.


definition_id: oval:org.debian:def:186903285877873758866230326005200363931
title: CVE-2013-4420 libtar
description:
Multiple directory traversal vulnerabilities in the (1) tar_extract_glob and (2) tar_extract_all functions in libtar 1.2.20 and earlier allow remote attackers to overwrite arbitrary files via a .. (dot dot) in a crafted tar file.


definition_id: oval:org.debian:def:297608934508085200046265620039600731716
title: CVE-2013-4421 dropbear
description:
The buf_decompress function in packet.c in Dropbear SSH Server before 2013.59 allows remote attackers to cause a denial of service (memory consumption) via a compressed packet that has a large size when it is decompressed.


definition_id: oval:org.debian:def:236581246442298808099555208335650248471
title: CVE-2013-4422 quassel
description:
SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.


definition_id: oval:org.debian:def:185948866072809872253566717328034090919
title: CVE-2013-4428 glance
description:
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID.


definition_id: oval:org.debian:def:73942391466416147944940796358073425438
title: CVE-2013-4434 dropbear
description:
Dropbear SSH Server before 2013.59 generates error messages for a failed logon attempt with different time delays depending on whether the user account exists, which allows remote attackers to discover valid usernames.


definition_id: oval:org.debian:def:330859651893988466519159651567791504664
title: CVE-2013-4435 salt
description:
Salt (aka SaltStack) 0.15.0 through 0.17.0 allows remote authenticated users who are using external authentication or client ACL to execute restricted routines by embedding the routine in another routine.


definition_id: oval:org.debian:def:21937527223586211029780760091602320800
title: CVE-2013-4436 salt
description:
The default configuration for salt-ssh in Salt (aka SaltStack) 0.17.0 does not validate the SSH host key of requests, which allows remote attackers to have unspecified impact via a man-in-the-middle (MITM) attack.


definition_id: oval:org.debian:def:119854574154677947594986068213735014696
title: CVE-2013-4437 salt
description:
Unspecified vulnerability in salt-ssh in Salt (aka SaltStack) 0.17.0 has unspecified impact and vectors related to "insecure Usage of /tmp."


definition_id: oval:org.debian:def:226568184969320531398691830930425566293
title: CVE-2013-4438 salt
description:
Salt (aka SaltStack) before 0.17.1 allows remote attackers to execute arbitrary YAML code via unspecified vectors.  NOTE: the vendor states that this might not be a vulnerability because the YAML to be loaded has already been determined to be safe.


definition_id: oval:org.debian:def:30347134319674987170503964928584129739
title: CVE-2013-4439 salt
description:
Salt (aka SaltStack) before 0.15.0 through 0.17.0 allows remote authenticated minions to impersonate arbitrary minions via a crafted minion with a valid key.


definition_id: oval:org.debian:def:198073867550547974882931956204087193469
title: CVE-2013-4440 pwgen
description:
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.


definition_id: oval:org.debian:def:281068739863528614432234037290143724680
title: CVE-2013-4442 pwgen
description:
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.


definition_id: oval:org.debian:def:288033369553834756089342728529579138893
title: CVE-2013-4449 openldap
description:
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.


definition_id: oval:org.debian:def:203935254280316681179957012406775058878
title: CVE-2013-4450 nodejs
description:
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response.


definition_id: oval:org.debian:def:158152637531452792183618190702928836080
title: CVE-2013-4458 glibc
description:
It was found that getaddrinfo() did not limit the amount of stack memory used during name resolution. An attacker able to make an application resolve an attacker-controlled hostname or IP address could possibly cause the application to exhaust all stack memory and crash.


definition_id: oval:org.debian:def:174881782750681936712803494374734955860
title: CVE-2013-4463 nova
description:
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.


definition_id: oval:org.debian:def:22314060629720115998256530882077782321
title: CVE-2013-4469 nova
description:
OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.


definition_id: oval:org.debian:def:255125736169141539175566416789441735417
title: CVE-2013-4471 horizon
description:
The Identity v3 API in OpenStack Dashboard (Horizon) before 2013.2 does not require the current password when changing passwords for user accounts, which makes it easier for remote attackers to change a user password by leveraging the authentication token for that user.


definition_id: oval:org.debian:def:42584425729554627178082909474418464726
title: CVE-2013-4473 poppler
description:
Stack-based buffer overflow in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a source filename.


definition_id: oval:org.debian:def:206744427537550549093503656867493891080
title: CVE-2013-4474 poppler
description:
Format string vulnerability in the extractPages function in utils/pdfseparate.cc in poppler before 0.24.3 allows remote attackers to cause a denial of service (crash) via format string specifiers in a destination filename.


definition_id: oval:org.debian:def:6154823968215300492327996288443034785
title: CVE-2013-4475 samba
description:
Samba 3.2.x through 3.6.x before 3.6.20, 4.0.x before 4.0.11, and 4.1.x before 4.1.1, when vfs_streams_depot or vfs_streams_xattr is enabled, allows remote attackers to bypass intended file restrictions by leveraging ACL differences between a file and an associated alternate data stream (ADS).


definition_id: oval:org.debian:def:173521808968762605876835637976007703136
title: CVE-2013-4476 samba
description:
Samba 4.0.x before 4.0.11 and 4.1.x before 4.1.1, when LDAP or HTTP is provided over SSL, uses world-readable permissions for a private key, which allows local users to obtain sensitive information by reading the key file, as demonstrated by access to the local filesystem on an AD domain controller.


definition_id: oval:org.debian:def:242589245288650573501798734516505278439
title: CVE-2013-4477 keystone
description:
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.


definition_id: oval:org.debian:def:316562426465346485108298161263403525789
title: CVE-2013-4478 sup-mail
description:
Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment.


definition_id: oval:org.debian:def:163509233840488519074445982967995677490
title: CVE-2013-4479 sup-mail
description:
lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment.


definition_id: oval:org.debian:def:268680674475662588414347524623779463662
title: CVE-2013-4483 linux
description:
The ipc_rcu_putref function in ipc/util.c in the Linux kernel before 3.10 does not properly manage a reference count, which allows local users to cause a denial of service (memory consumption or system crash) via a crafted application.


definition_id: oval:org.debian:def:49897807653569853636654441535121162405
title: CVE-2013-4484 varnish
description:
Varnish before 3.0.5 allows remote attackers to cause a denial of service (child-process crash and temporary caching outage) via a GET request with trailing whitespace characters and no URI.


definition_id: oval:org.debian:def:23801320459648076985739269967543012485
title: CVE-2013-4485 389-ds-base
description:
389 Directory Server 1.2.11.15 (aka Red Hat Directory Server before 8.2.11-14) allows remote authenticated users to cause a denial of service (crash) via multiple @ characters in a GER attribute list in a search request.


definition_id: oval:org.debian:def:268586629898784109579880378496111099560
title: CVE-2013-4494 xen
description:
Xen before 4.1.x, 4.2.x, and 4.3.x does not take the page_alloc_lock and grant_table.lock in the same order, which allows local guest administrators with access to multiple vcpus to cause a denial of service (host deadlock) via unspecified vectors.


definition_id: oval:org.debian:def:287601825553269515583309605270446631427
title: CVE-2013-4496 samba
description:
Samba 3.x before 3.6.23, 4.0.x before 4.0.16, and 4.1.x before 4.1.6 does not enforce the password-guessing protection mechanism for all interfaces, which makes it easier for remote attackers to obtain access via brute-force ChangePasswordUser2 (1) SAMR or (2) RAP attempts.


definition_id: oval:org.debian:def:174919050372406050482803532292255724199
title: CVE-2013-4497 nova
description:
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.


definition_id: oval:org.debian:def:36418837779492271179390947920720418858
title: CVE-2013-4505 subversion
description:
The is_this_legal function in mod_dontdothat for Apache Subversion 1.4.0 through 1.7.13 and 1.8.0 through 1.8.4 allows remote attackers to bypass intended access restrictions and possibly cause a denial of service (resource consumption) via a relative URL in a REPORT request.


definition_id: oval:org.debian:def:73355641366504596444743795973698189089
title: CVE-2013-4508 lighttpd
description:
lighttpd before 1.4.34, when SNI is enabled, configures weak SSL ciphers, which makes it easier for remote attackers to hijack sessions by inserting packets into the client-server data stream or obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:152175074690956399272983632899526789820
title: CVE-2013-4509 ibus-anthy
description:
The default configuration of IBUS 1.5.4, and possibly 1.5.2 and earlier, when IBus.InputPurpose.PASSWORD is not set and used with GNOME 3, does not obscure the entered password characters, which allows physically proximate attackers to obtain a user password by reading the lockscreen.


definition_id: oval:org.debian:def:119693508410470936778368034094830731251
title: CVE-2013-4510 tryton-client
description:
Directory traversal vulnerability in the client in Tryton 3.0.0, as distributed before 20131104 and earlier, allows remote servers to write arbitrary files via path separators in the extension of a report.


definition_id: oval:org.debian:def:127938413886702686987810386953056076150
title: CVE-2013-4511 linux
description:
Multiple integer overflows in Alchemy LCD frame-buffer drivers in the Linux kernel before 3.12 allow local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted mmap operations, related to the (1) au1100fb_fb_mmap function in drivers/video/au1100fb.c and the (2) au1200fb_fb_mmap function in drivers/video/au1200fb.c.


definition_id: oval:org.debian:def:89174156305283821651029063353039184126
title: CVE-2013-4512 linux
description:
Buffer overflow in the exitcode_proc_write function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.


definition_id: oval:org.debian:def:154908002017037413210383047509941768499
title: CVE-2013-4513 linux
description:
Buffer overflow in the oz_cdev_write function in drivers/staging/ozwpan/ozcdev.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact via a crafted write operation.


definition_id: oval:org.debian:def:257065638294793689944738497879509875400
title: CVE-2013-4514 linux
description:
Multiple buffer overflows in drivers/staging/wlags49_h2/wl_priv.c in the Linux kernel before 3.12 allow local users to cause a denial of service or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability and providing a long station-name string, related to the (1) wvlan_uil_put_info and (2) wvlan_set_station_nickname functions.


definition_id: oval:org.debian:def:59294942439045339156704598161554557138
title: CVE-2013-4515 linux
description:
The bcm_char_ioctl function in drivers/staging/bcm/Bcmchar.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an IOCTL_BCM_GET_DEVICE_DRIVER_INFO ioctl call.


definition_id: oval:org.debian:def:19176286765099820534646955067102781335
title: CVE-2013-4516 linux
description:
The mp_get_count function in drivers/staging/sb105x/sb_pci_mp.c in the Linux kernel before 3.12 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a TIOCGICOUNT ioctl call.


definition_id: oval:org.debian:def:275766015926990764812582354869439536063
title: CVE-2013-4517 libxml-security-java
description:
Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.


definition_id: oval:org.debian:def:42480242069137883034087212668941281188
title: CVE-2013-4526 qemu
description:
Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via vectors related to migrating ports.


definition_id: oval:org.debian:def:140473811728941010477236613040575579028
title: CVE-2013-4530 qemu
description:
Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted tx_fifo_head and rx_fifo_head values in a savevm image.


definition_id: oval:org.debian:def:5593972160479664809183783544118907774
title: CVE-2013-4531 qemu
description:
Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a negative value in cpreg_vmstate_array_len in a savevm image.


definition_id: oval:org.debian:def:111289885784597415542840669718992621873
title: CVE-2013-4532 qemu
description:
Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.


definition_id: oval:org.debian:def:81292931911834757418591931886437770837
title: CVE-2013-4533 qemu
description:
Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted s->rx_level value in a savevm image.


definition_id: oval:org.debian:def:114962239884999103281403452652075719861
title: CVE-2013-4534 qemu
description:
Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors related to IRQDest elements.


definition_id: oval:org.debian:def:266612139657962196318861818057690980704
title: CVE-2013-4535 qemu
description:
The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.


definition_id: oval:org.debian:def:119801773638580168417600926851565025829
title: CVE-2013-4536 qemu
description:
An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.


definition_id: oval:org.debian:def:10176986112996065211396707003533601330
title: CVE-2013-4537 qemu
description:
The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.


definition_id: oval:org.debian:def:7419986073238821663681673934251275540
title: CVE-2013-4538 qemu
description:
Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via crafted (1) cmd_len, (2) row, or (3) col values; (4) row_start and row_end values; or (5) col_star and col_end values in a savevm image.


definition_id: oval:org.debian:def:251179576998721094098370240113004513494
title: CVE-2013-4539 qemu
description:
Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted (1) precision, (2) nextprecision, (3) function, or (4) nextfunction value in a savevm image.


definition_id: oval:org.debian:def:164121436276282962838848539506381644122
title: CVE-2013-4540 qemu
description:
Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) prev_level, (2) gpio_level, or (3) gpio_dir value in a savevm image.


definition_id: oval:org.debian:def:69522513813075420568185773353100169308
title: CVE-2013-4541 qemu
description:
The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image, related to a negative setup_len or setup_index value.


definition_id: oval:org.debian:def:318272085681533266874883613385637812437
title: CVE-2013-4544 qemu
description:
hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary code via vectors related to (1) RX or (2) TX queue numbers or (3) interrupt indices.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:66292852750214821475162193675106483749
title: CVE-2013-4545 curl
description:
cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:66086061711690187894299839939356438546
title: CVE-2013-4547 nginx
description:
nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.


definition_id: oval:org.debian:def:128561943397998086450921648869202274808
title: CVE-2013-4548 openssh
description:
The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initialize memory for a MAC context data structure, which allows remote authenticated users to bypass intended ForceCommand and login-shell restrictions via packet data that provides a crafted callback address.


definition_id: oval:org.debian:def:195746744504625764886998021175201520753
title: CVE-2013-4549 qt4-x11
description:
QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:283933235066468654517427089781145227253
title: CVE-2013-4550 bip
description:
Bip before 0.8.9, when running as a daemon, writes SSL handshake errors to an unexpected file descriptor that was previously associated with stderr before stderr has been closed, which allows remote attackers to write to other sockets and have an unspecified impact via a failed SSL handshake, a different vulnerability than CVE-2011-5268. NOTE: some sources originally mapped this CVE to two different types of issues; this CVE has since been SPLIT, producing CVE-2011-5268.


definition_id: oval:org.debian:def:292947531814538767235104858282473903825
title: CVE-2013-4551 xen
description:
Xen 4.2.x and 4.3.x, when nested virtualization is disabled, does not properly check the emulation paths for (1) VMLAUNCH and (2) VMRESUME, which allows local HVM guest users to cause a denial of service (host crash) via unspecified vectors related to "guest VMX instruction execution."


definition_id: oval:org.debian:def:332736541481982405316684495756627578157
title: CVE-2013-4553 xen
description:
The XEN_DOMCTL_getmemlist hypercall in Xen 3.4.x through 4.3.x (possibly 4.3.1) does not always obtain the page_alloc_lock and mm_rwlock in the same order, which allows local guest administrators to cause a denial of service (host deadlock).


definition_id: oval:org.debian:def:235439247520492353952710888522197801754
title: CVE-2013-4555 spip
description:
Cross-site request forgery (CSRF) vulnerability in ecrire/action/logout.php in SPIP before 2.1.24 allows remote attackers to hijack the authentication of arbitrary users for requests that logout the user via unspecified vectors.


definition_id: oval:org.debian:def:216377989118770810808858782817836541981
title: CVE-2013-4556 spip
description:
Cross-site scripting (XSS) vulnerability in the author page (prive/formulaires/editer_auteur.php) in SPIP before 2.1.24 and 3.0.x before 3.0.12 allows remote attackers to inject arbitrary web script or HTML via the url_site parameter.


definition_id: oval:org.debian:def:251170128487819691892662239990436059692
title: CVE-2013-4557 spip
description:
The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.


definition_id: oval:org.debian:def:230028902562984398600312331733459004095
title: CVE-2013-4558 subversion
description:
The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.


definition_id: oval:org.debian:def:107224783433367454071132741636384992303
title: CVE-2013-4559 lighttpd
description:
lighttpd before 1.4.33 does not check the return value of the (1) setuid, (2) setgid, or (3) setgroups functions, which might cause lighttpd to run as root if it is restarted and allows remote attackers to gain privileges, as demonstrated by multiple calls to the clone function that cause setuid to fail when the user process limit is reached.


definition_id: oval:org.debian:def:132057752694434891668984076269564752377
title: CVE-2013-4560 lighttpd
description:
Use-after-free vulnerability in lighttpd before 1.4.33 allows remote attackers to cause a denial of service (segmentation fault and crash) via unspecified vectors that trigger FAMMonitorDirectory failures.


definition_id: oval:org.debian:def:49039734986193230855382822674906773360
title: CVE-2013-4563 linux
description:
The udp6_ufo_fragment function in net/ipv6/udp_offload.c in the Linux kernel through 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly perform a certain size comparison before inserting a fragment header, which allows remote attackers to cause a denial of service (panic) via a large IPv6 UDP packet, as demonstrated by use of the Token Bucket Filter (TBF) queueing discipline.


definition_id: oval:org.debian:def:236628148418808383221675695269422853957
title: CVE-2013-4567 mediawiki
description:
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via a \b (backspace) character in CSS.


definition_id: oval:org.debian:def:118507021071120771875740840453679284015
title: CVE-2013-4568 mediawiki
description:
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.


definition_id: oval:org.debian:def:209252747731344192761958076831565653498
title: CVE-2013-4572 mediawiki
description:
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.


definition_id: oval:org.debian:def:71515508870232364351138821743281311306
title: CVE-2013-4577 grub2
description:
A certain Debian patch for GNU GRUB uses world-readable permissions for grub.cfg, which allows local users to obtain password hashes, as demonstrated by reading the password_pbkdf2 directive in the file.


definition_id: oval:org.debian:def:247141920491245216402619576872643334093
title: CVE-2013-4579 linux
description:
The ath9k_htc_set_bssid_mask function in drivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through 3.12 uses a BSSID masking approach to determine the set of MAC addresses on which a Wi-Fi device is listening, which allows remote attackers to discover the original MAC address after spoofing by sending a series of packets to MAC addresses with certain bit manipulations.


definition_id: oval:org.debian:def:337641540389044376787121805961039652719
title: CVE-2013-4584 perdition
description:
Perdition before 2.2 may have weak security when handling outbound connections, caused by an error in the STARTTLS IMAP and POP server. ssl_outgoing_ciphers not being applied to STARTTLS connections


definition_id: oval:org.debian:def:44739645492869904489891113382405539648
title: CVE-2013-4587 linux
description:
Array index error in the kvm_vm_ioctl_create_vcpu function in virt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges via a large id value.


definition_id: oval:org.debian:def:65646373764753188312801886169177512607
title: CVE-2013-4589 graphicsmagick
description:
The ExportAlphaQuantumType function in export.c in GraphicsMagick before 1.3.18 might allow remote attackers to cause a denial of service (crash) via vectors related to exporting the alpha of an 8-bit RGBA image.


definition_id: oval:org.debian:def:19130382427188268014611375919933752564
title: CVE-2013-4591 linux
description:
Buffer overflow in the __nfs4_get_acl_uncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4_acl extended attribute of a pathname on an NFSv4 filesystem.


definition_id: oval:org.debian:def:105372875601017801655618985701275802671
title: CVE-2013-4668 file-roller
description:
Directory traversal vulnerability in File Roller 3.6.x before 3.6.4, 3.8.x before 3.8.3, and 3.9.x before 3.9.3, when libarchive is used, allows remote attackers to create arbitrary files via a crafted archive that is not properly handled in a "Keep directory structure" action, related to fr-archive-libarchive.c and fr-window.c.


definition_id: oval:org.debian:def:117119013422332071406885182213316289890
title: CVE-2013-4717 otrs2
description:
Multiple SQL injection vulnerabilities in Open Ticket Request System (OTRS) Help Desk 3.0.x before 3.0.22, 3.1.x before 3.1.18, and 3.2.x before 3.2.9 allow remote authenticated users to execute arbitrary SQL commands via unspecified vectors related to Kernel/Output/HTML/PreferencesCustomQueue.pm, Kernel/System/CustomerCompany.pm, Kernel/System/Ticket/IndexAccelerator/RuntimeDB.pm, Kernel/System/Ticket/IndexAccelerator/StaticDB.pm, and Kernel/System/TicketSearch.pm.


definition_id: oval:org.debian:def:334962466050927106856407412234123972872
title: CVE-2013-4761 puppet
description:
Unspecified vulnerability in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, allows remote attackers to execute arbitrary Ruby programs from the master via the resource_type service.  NOTE: this vulnerability can only be exploited utilizing unspecified "local file system access" to the Puppet Master.


definition_id: oval:org.debian:def:43224702721068656403001231944566630852
title: CVE-2013-4788 glibc
description:
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer guard, which makes it easier for context-dependent attackers to control execution flow by leveraging a buffer-overflow vulnerability in an application and using the known zero value pointer guard to calculate a pointer address.


definition_id: oval:org.debian:def:245806844550531385669304562201987248503
title: CVE-2013-4852 filezilla
description:
Integer overflow in PuTTY 0.62 and earlier, WinSCP before 5.1.6, and other products that use PuTTY allows remote SSH servers to cause a denial of service (crash) and possibly execute arbitrary code in certain applications that use PuTTY via a negative size value in an RSA key signature during the SSH handshake, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:5620525312037170592204778660037068945
title: CVE-2013-4854 bind9
description:
The RFC 5011 implementation in rdata.c in ISC BIND 9.7.x and 9.8.x before 9.8.5-P2, 9.8.6b1, 9.9.x before 9.9.3-P2, and 9.9.4b1, and DNSco BIND 9.9.3-S1 before 9.9.3-S1-P1 and 9.9.4-S1b1, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query with a malformed RDATA section that is not properly handled during construction of a log message, as exploited in the wild in July 2013.


definition_id: oval:org.debian:def:227439131271422774847465522208709252042
title: CVE-2013-4885 nmap
description:
The http-domino-enum-passwords.nse script in NMap before 6.40, when domino-enum-passwords.idpath is set, allows remote servers to upload "arbitrarily named" files via a crafted FullName parameter in a response, as demonstrated using directory traversal sequences.


definition_id: oval:org.debian:def:280633545613456772768378351702391030378
title: CVE-2013-4920 wireshark
description:
The P1 dissector in Wireshark 1.10.x before 1.10.1 does not properly initialize a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:39501730217339489170218526235576802961
title: CVE-2013-4921 wireshark
description:
Off-by-one error in the dissect_radiotap function in epan/dissectors/packet-ieee80211-radiotap.c in the Radiotap dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:236658770004875290202578849100157777150
title: CVE-2013-4922 wireshark
description:
Double free vulnerability in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:47072413016412925697070709881103460101
title: CVE-2013-4923 wireshark
description:
Memory leak in the dissect_dcom_ActivationProperties function in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (memory consumption) via crafted packets.


definition_id: oval:org.debian:def:171969405585706311207011583705003978795
title: CVE-2013-4924 wireshark
description:
epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly validate certain index values, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


definition_id: oval:org.debian:def:138338023166169227519472722970438320265
title: CVE-2013-4925 wireshark
description:
Integer signedness error in epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted packet.


definition_id: oval:org.debian:def:255745170848690106146192781110914670581
title: CVE-2013-4926 wireshark
description:
epan/dissectors/packet-dcom-sysact.c in the DCOM ISystemActivator dissector in Wireshark 1.10.x before 1.10.1 does not properly determine whether there is remaining packet data to process, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:52537377516734708428968160822783596729
title: CVE-2013-4927 wireshark
description:
Integer signedness error in the get_type_length function in epan/dissectors/packet-btsdp.c in the Bluetooth SDP dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.


definition_id: oval:org.debian:def:61967171738862494314304774068204892927
title: CVE-2013-4928 wireshark
description:
Integer signedness error in the dissect_headers function in epan/dissectors/packet-btobex.c in the Bluetooth OBEX dissector in Wireshark 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:21977677969662768915592682569545288938
title: CVE-2013-4929 wireshark
description:
The parseFields function in epan/dissectors/packet-dis-pdus.c in the DIS dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not terminate packet-data processing after finding zero remaining bytes, which allows remote attackers to cause a denial of service (loop) via a crafted packet.


definition_id: oval:org.debian:def:133342085588095399704834924587017797742
title: CVE-2013-4930 wireshark
description:
The dissect_dvbci_tpdu_hdr function in epan/dissectors/packet-dvbci.c in the DVB-CI dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not validate a certain length value before decrementing it, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted packet.


definition_id: oval:org.debian:def:301824581310806582331666689786047317767
title: CVE-2013-4931 wireshark
description:
epan/proto.c in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allows remote attackers to cause a denial of service (loop) via a crafted packet that is not properly handled by the GSM RR dissector.


definition_id: oval:org.debian:def:282999590002750346048691500847540372298
title: CVE-2013-4932 wireshark
description:
Multiple array index errors in epan/dissectors/packet-gsm_a_common.c in the GSM A Common dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 allow remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:204003563653984249676396693752290666235
title: CVE-2013-4933 wireshark
description:
The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.


definition_id: oval:org.debian:def:113102003001395560305994681496242291511
title: CVE-2013-4934 wireshark
description:
The netmon_open function in wiretap/netmon.c in the Netmon file parser in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize certain structure members, which allows remote attackers to cause a denial of service (application crash) via a crafted packet-trace file.


definition_id: oval:org.debian:def:325656039557579433187306992298509892196
title: CVE-2013-4935 wireshark
description:
The dissect_per_length_determinant function in epan/dissectors/packet-per.c in the ASN.1 PER dissector in Wireshark 1.8.x before 1.8.9 and 1.10.x before 1.10.1 does not initialize a length field in certain abnormal situations, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:290599151525005420780233373543710013121
title: CVE-2013-4936 wireshark
description:
The IsDFP_Frame function in plugins/profinet/packet-pn-rt.c in the PROFINET Real-Time dissector in Wireshark 1.10.x before 1.10.1 does not validate MAC addresses, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet.


definition_id: oval:org.debian:def:242818389066980363052697305797488593819
title: CVE-2013-4956 puppet
description:
Puppet Module Tool (PMT), as used in Puppet 2.7.x before 2.7.23 and 3.2.x before 3.2.4, and Puppet Enterprise 2.8.x before 2.8.3 and 3.0.x before 3.0.1, installs modules with weak permissions if those permissions were used when the modules were originally built, which might allow local users to read or modify those modules depending on the original permissions.


definition_id: oval:org.debian:def:104695649143846386215657986424948306629
title: CVE-2013-4969 puppet
description:
Puppet before 3.3.3 and 3.4 before 3.4.1 and Puppet Enterprise (PE) before 2.8.4 and 3.1 before 3.1.1 allows local users to overwrite arbitrary files via a symlink attack on unspecified files.


definition_id: oval:org.debian:def:86292786635322411938851402180036144137
title: CVE-2013-5093 graphite-web
description:
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.


definition_id: oval:org.debian:def:222852512588150017829391634351945751060
title: CVE-2013-5123 python-pip
description:
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.


definition_id: oval:org.debian:def:272008275390174100279903091682175148103
title: CVE-2013-5209 kfreebsd-10
description:
The sctp_send_initiate_ack function in sys/netinet/sctp_output.c in the SCTP implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE does not properly initialize the state-cookie data structure, which allows remote attackers to obtain sensitive information from kernel stack memory by reading packet data in INIT-ACK chunks.


definition_id: oval:org.debian:def:244764459481210209191691522571298896153
title: CVE-2013-5211 ntp
description:
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as exploited in the wild in December 2013.


definition_id: oval:org.debian:def:170047474345868597644255138640007459271
title: CVE-2013-5572 zabbix
description:
Zabbix 2.0.5 allows remote authenticated users to discover the LDAP bind password by leveraging management-console access and reading the ldap_bind_password value in the HTML source code.


definition_id: oval:org.debian:def:180257804853101438999760514597936793753
title: CVE-2013-5587 request-tracker4
description:
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before 4.0.13, when MakeClicky is configured, allows remote attackers to inject arbitrary web script or HTML via a URL in a ticket.  NOTE: this issue has been SPLIT from CVE-2013-3371 due to different affected versions.


definition_id: oval:org.debian:def:98546573627786571813825966201631928542
title: CVE-2013-5588 cacti
description:
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2) the id parameter to cacti/host.php.


definition_id: oval:org.debian:def:273690725440177176828436963025338080880
title: CVE-2013-5589 cacti
description:
SQL injection vulnerability in cacti/host.php in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.


definition_id: oval:org.debian:def:55907934587548785939508974147319607083
title: CVE-2013-5605 nss
description:
Mozilla Network Security Services (NSS) 3.14 before 3.14.5 and 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via invalid handshake packets.


definition_id: oval:org.debian:def:311848489079754591248197107448136357974
title: CVE-2013-5606 nss
description:
The CERT_VerifyCert function in lib/certhigh/certvfy.c in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 provides an unexpected return value for an incompatible key-usage certificate when the CERTVerifyLog argument is valid, which might allow remote attackers to bypass intended access restrictions via a crafted certificate.


definition_id: oval:org.debian:def:259475343824622514736066900095230923005
title: CVE-2013-5607 nspr
description:
Integer overflow in the PL_ArenaAllocate function in Mozilla Netscape Portable Runtime (NSPR) before 4.10.2, as used in Firefox before 25.0.1, Firefox ESR 17.x before 17.0.11 and 24.x before 24.1.1, and SeaMonkey before 2.22.1, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted X.509 certificate, a related issue to CVE-2013-1741.


definition_id: oval:org.debian:def:283167165813124430514381179637365737337
title: CVE-2013-5634 linux
description:
arch/arm/kvm/arm.c in the Linux kernel before 3.10 on the ARM platform, when KVM is used, allows host OS users to cause a denial of service (NULL pointer dereference, OOPS, and host OS crash) or possibly have unspecified other impact by omitting vCPU initialization before a KVM_GET_REG_LIST ioctl call.


definition_id: oval:org.debian:def:147234289003985312193477107982731236275
title: CVE-2013-5641 asterisk
description:
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.17.x through 1.8.22.x, 1.8.23.x before 1.8.23.1, and 11.x before 11.5.1 and Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2 allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an ACK with SDP to a previously terminated channel.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:261079899423826211877341236653827856206
title: CVE-2013-5642 asterisk
description:
The SIP channel driver (channels/chan_sip.c) in Asterisk Open Source 1.8.x before 1.8.23.1, 10.x before 10.12.3, and 11.x before 11.5.1; Certified Asterisk 1.8.15 before 1.8.15-cert3 and 11.2 before 11.2-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.3-digiumphones allows remote attackers to cause a denial of service (NULL pointer dereference, segmentation fault, and daemon crash) via an invalid SDP that defines a media description before the connection description in a SIP request.


definition_id: oval:org.debian:def:293269985428950366620258550575421933307
title: CVE-2013-5645 roundcube
description:
Multiple cross-site scripting (XSS) vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in (1) new or (2) draft mode, related to compose.inc; and (3) might allow remote authenticated users to inject arbitrary web script or HTML via an HTML signature, related to save_identity.inc.


definition_id: oval:org.debian:def:179439156121865161098667979750455498209
title: CVE-2013-5651 libvirt
description:
The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) via a crafted bitmap, as demonstrated by a large nodeset value to numatune.


definition_id: oval:org.debian:def:208788614481763459277764385453397469516
title: CVE-2013-5653 ghostscript
description:
The getenv and filenameforall functions in Ghostscript 9.10 ignore the "-dSAFER" argument, which allows remote attackers to read data via a crafted postscript file.


definition_id: oval:org.debian:def:322473268203351944722708127401544356582
title: CVE-2013-5704 apache2
description:
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states "this is not a security issue in httpd as such."


definition_id: oval:org.debian:def:6713227512259477434490795866654516033
title: CVE-2013-5705 modsecurity-apache
description:
apache2/modsecurity.c in ModSecurity before 2.7.6 allows remote attackers to bypass rules by using chunked transfer coding with a capitalized Chunked value in the Transfer-Encoding HTTP header.


definition_id: oval:org.debian:def:182782869796750290682854022367074401387
title: CVE-2013-5717 wireshark
description:
The Bluetooth HCI ACL dissector in Wireshark 1.10.x before 1.10.2 does not properly maintain a certain free list, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that is not properly handled by the wmem_block_alloc function in epan/wmem/wmem_allocator_block.c.


definition_id: oval:org.debian:def:78877279311434866171758624655098007608
title: CVE-2013-5718 wireshark
description:
The dissect_nbap_T_dCH_ID function in epan/dissectors/packet-nbap.c in the NBAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not restrict the dch_id value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:339740181507424917583962328860412957560
title: CVE-2013-5719 wireshark
description:
epan/dissectors/packet-assa_r3.c in the ASSA R3 dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:212599873978561768903527998219416558111
title: CVE-2013-5720 wireshark
description:
Buffer overflow in the RTPS dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:183562157241352399951413960017896101660
title: CVE-2013-5721 wireshark
description:
The dissect_mq_rr function in epan/dissectors/packet-mq.c in the MQ dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 does not properly determine when to enter a certain loop, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:9424122151261345200982731166808145941
title: CVE-2013-5722 wireshark
description:
Unspecified vulnerability in the LDAP dissector in Wireshark 1.8.x before 1.8.10 and 1.10.x before 1.10.2 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:85927645171223854134969488243416677673
title: CVE-2013-5738 wordpress
description:
The get_allowed_mime_types function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfiltered_html capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file.


definition_id: oval:org.debian:def:198490426382145111991152443142621270217
title: CVE-2013-5739 wordpress
description:
The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting (XSS) attacks via a crafted file, related to the get_allowed_mime_types function in wp-includes/functions.php.


definition_id: oval:org.debian:def:188703798310487563122349655180856317966
title: CVE-2013-5743 zabbix
description:
Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7.


definition_id: oval:org.debian:def:276061119653914379642815821889724557560
title: CVE-2013-5745 vino
description:
The vino_server_client_data_pending function in vino-server.c in GNOME Vino 2.26.1, 2.32.1, 3.7.3, and earlier, and 3.8 when encryption is disabled, does not properly clear client data when an error causes the connection to close during authentication, which allows remote attackers to cause a denial of service (infinite loop, CPU and disk consumption) via multiple crafted requests during authentication.


definition_id: oval:org.debian:def:239234905147802584267289966465947383912
title: CVE-2013-5855 mojarra
description:
Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.


definition_id: oval:org.debian:def:198826701948743901094594485815148148517
title: CVE-2013-5919 suricata
description:
Suricata before 1.4.6 allows remote attackers to cause a denial of service (crash) via a malformed SSL record.


definition_id: oval:org.debian:def:81951331579338269826535158892559667693
title: CVE-2013-5942 graphite-web
description:
Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to (1) remote_storage.py, (2) storage.py, (3) render/datalib.py, and (4) whitelist/views.py, a different vulnerability than CVE-2013-5093.


definition_id: oval:org.debian:def:325393302277741490747903071500264084995
title: CVE-2013-5943 graphite-web
description:
Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:53557951117834490699776433579702813116
title: CVE-2013-5986 nvidia-graphics-drivers
description:
Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 has unknown impact and attack vectors, a different vulnerability than CVE-2013-5987.


definition_id: oval:org.debian:def:260376934499240705708475347710717913687
title: CVE-2013-5987 nvidia-graphics-drivers
description:
Unspecified vulnerability in NVIDIA graphics driver Release 331, 325, 319, 310, and 304 allows local users to bypass intended access restrictions for the GPU and gain privileges via unknown vectors.


definition_id: oval:org.debian:def:285760787408964389658938680072419320597
title: CVE-2013-6044 python-django
description:
The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by "the login view in django.contrib.auth.views" and the javascript: scheme.


definition_id: oval:org.debian:def:304855537541772431098406424109623099339
title: CVE-2013-6047 ikiwiki-hosting
description:
Multiple cross-site scripting (XSS) vulnerabilities in the site creation interface in ikiwiki-hosting before 0.20131025 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:88395078494215161868219121197587355090
title: CVE-2013-6048 munin
description:
The get_group_tree function in lib/Munin/Master/HTMLConfig.pm in Munin before 2.0.18 allows remote nodes to cause a denial of service (infinite loop and memory consumption in the munin-html process) via crafted multigraph data.


definition_id: oval:org.debian:def:241682960362421323053088430277129796851
title: CVE-2013-6049 apt-listbugs
description:
apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:304864585721365250674738379837034133482
title: CVE-2013-6050 links2
description:
Integer overflow in Links before 2.8 allows remote attackers to cause a denial of service (crash) via crafted HTML tables.


definition_id: oval:org.debian:def:183877361225665805349485818342972999773
title: CVE-2013-6051 quagga
description:
The bgp_attr_unknown function in bgp_attr.c in Quagga 0.99.21 does not properly initialize the total variable, which allows remote attackers to cause a denial of service (bgpd crash) via a crafted BGP update.


definition_id: oval:org.debian:def:97511841374664940068080028173018436601
title: CVE-2013-6075 strongswan
description:
The compare_dn function in utils/identification.c in strongSwan 4.3.3 through 5.1.1 allows (1) remote attackers to cause a denial of service (out-of-bounds read, NULL pointer dereference, and daemon crash) or (2) remote authenticated users to impersonate arbitrary users and bypass access restrictions via a crafted ID_DER_ASN1_DN ID, related to an "insufficient length check" during identity comparison.


definition_id: oval:org.debian:def:214042990753540303161071663890982165914
title: CVE-2013-6076 strongswan
description:
strongSwan 5.0.2 through 5.1.0 allows remote attackers to cause a denial of service (NULL pointer dereference and charon daemon crash) via a crafted IKEv1 fragmentation packet.


definition_id: oval:org.debian:def:153389993771729261316350169329000986773
title: CVE-2013-6169 ejabberd
description:
The TLS driver in ejabberd before 2.1.12 supports (1) SSLv2 and (2) weak SSL ciphers, which makes it easier for remote attackers to obtain sensitive information via a brute-force attack.


definition_id: oval:org.debian:def:54816003310688420306290651217976685216
title: CVE-2013-6171 dovecot
description:
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server.


definition_id: oval:org.debian:def:153362178440739452698029298908535471873
title: CVE-2013-6172 roundcube
description:
steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter, which can be leveraged to read arbitrary files, conduct SQL injection attacks, and execute arbitrary code.


definition_id: oval:org.debian:def:313612437605161471590750611564107169752
title: CVE-2013-6282 linux
description:
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013.


definition_id: oval:org.debian:def:22616641569022110152561423169405947053
title: CVE-2013-6283 vlc
description:
VideoLAN VLC Media Player 2.0.8 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a URL in a m3u file.


definition_id: oval:org.debian:def:216042480444044544329542978467193527005
title: CVE-2013-6336 wireshark
description:
The ieee802154_map_rec function in epan/dissectors/packet-ieee802154.c in the IEEE 802.15.4 dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 uses an incorrect pointer chain, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:241667477753317896529180544121925666144
title: CVE-2013-6337 wireshark
description:
Unspecified vulnerability in the NBAP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:154433470403070214057025064266979015658
title: CVE-2013-6338 wireshark
description:
The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly initialize a data structure, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:276043683712849857517783462379346762813
title: CVE-2013-6339 wireshark
description:
The dissect_openwire_type function in epan/dissectors/packet-openwire.c in the OpenWire dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 allows remote attackers to cause a denial of service (loop) via a crafted packet.


definition_id: oval:org.debian:def:264869108119521957981042319938388830079
title: CVE-2013-6340 wireshark
description:
epan/dissectors/packet-tcp.c in the TCP dissector in Wireshark 1.8.x before 1.8.11 and 1.10.x before 1.10.3 does not properly determine the amount of remaining data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:220106980321062175476386777202174273799
title: CVE-2013-6359 munin
description:
Munin::Master::Node in Munin before 2.0.18 allows remote attackers to cause a denial of service (abort data collection for node) via a plugin that uses "multigraph" as a multigraph service name.


definition_id: oval:org.debian:def:284570160419518090306218894343347936532
title: CVE-2013-6367 linux
description:
The apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (divide-by-zero error and host OS crash) via crafted modifications of the TMICT value.


definition_id: oval:org.debian:def:81965347898649677966063976714406045132
title: CVE-2013-6368 linux
description:
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.


definition_id: oval:org.debian:def:161391711062350223013404237197763135060
title: CVE-2013-6369 jbigkit
description:
Stack-based buffer overflow in the jbg_dec_in function in libjbig/jbig.c in JBIG-KIT before 2.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted image file.


definition_id: oval:org.debian:def:80235281226872708073842850266290091148
title: CVE-2013-6370 json-c
description:
Buffer overflow in the printbuf APIs in json-c before 0.12 allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:41905072022568715456450426268571053164
title: CVE-2013-6371 json-c
description:
The hash functionality in json-c before 0.12 allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted JSON data, involving collisions.


definition_id: oval:org.debian:def:83608420343908554741998282145486397289
title: CVE-2013-6375 xen
description:
Xen 4.2.x and 4.3.x, when using Intel VT-d for PCI passthrough, does not properly flush the TLB after clearing a present translation table entry, which allows local guest administrators to cause a denial of service or gain privileges via unspecified vectors related to an "inverted boolean parameter."


definition_id: oval:org.debian:def:141408842562189075775492347463350675076
title: CVE-2013-6376 linux
description:
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.


definition_id: oval:org.debian:def:246732956172988126886679699832915476597
title: CVE-2013-6378 linux
description:
The lbs_debugfs_write function in drivers/net/wireless/libertas/debugfs.c in the Linux kernel through 3.12.1 allows local users to cause a denial of service (OOPS) by leveraging root privileges for a zero-length write operation.


definition_id: oval:org.debian:def:250097151762350674949165139607395891795
title: CVE-2013-6380 linux
description:
The aac_send_raw_srb function in drivers/scsi/aacraid/commctrl.c in the Linux kernel through 3.12.1 does not properly validate a certain size value, which allows local users to cause a denial of service (invalid pointer dereference) or possibly have unspecified other impact via an FSACTL_SEND_RAW_SRB ioctl call that triggers a crafted SRB command.


definition_id: oval:org.debian:def:621087567448062120457218485458816400
title: CVE-2013-6382 linux
description:
Multiple buffer underflows in the XFS implementation in the Linux kernel through 3.12.1 allow local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging the CAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2) XFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value, related to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c and the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c.


definition_id: oval:org.debian:def:90149033608162957194405799914006632437
title: CVE-2013-6383 linux
description:
The aac_compat_ioctl function in drivers/scsi/aacraid/linit.c in the Linux kernel before 3.11.8 does not require the CAP_SYS_RAWIO capability, which allows local users to bypass intended access restrictions via a crafted ioctl call.


definition_id: oval:org.debian:def:268668803478606318592232120347934184452
title: CVE-2013-6384 ceilometer
description:
(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.


definition_id: oval:org.debian:def:49137864438827614182765874786406461313
title: CVE-2013-6391 keystone
description:
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.


definition_id: oval:org.debian:def:14274176382451701278617139017839068933
title: CVE-2013-6393 libyaml
description:
The yaml_parser_scan_tag_uri function in scanner.c in LibYAML before 0.1.5 performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via crafted tags in a YAML document, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:175325008108153698257490421516867063546
title: CVE-2013-6395 ganglia
description:
Cross-site scripting (XSS) vulnerability in header.php in Ganglia Web 3.5.8 and 3.5.10 allows remote attackers to inject arbitrary web script or HTML via the host_regex parameter to the default URI, which is processed by get_context.php.


definition_id: oval:org.debian:def:44342894591148469686371927059832683723
title: CVE-2013-6396 python-swiftclient
description:
The OpenStack Python client library for Swift (python-swiftclient) 1.0 through 1.9.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


definition_id: oval:org.debian:def:289768093970723827351834952676191578347
title: CVE-2013-6397 lucene-solr
description:
Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT.  NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.


definition_id: oval:org.debian:def:197903899422856147841957811634646976806
title: CVE-2013-6400 xen
description:
Xen 4.2.x and 4.3.x, when using Intel VT-d and a PCI device has been assigned, does not clear the flag that suppresses IOMMU TLB flushes when unspecified errors occur, which causes the TLB entries to not be flushed and allows local guest administrators to cause a denial of service (host crash) or gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:196183361567073088917552890956668043636
title: CVE-2013-6401 jansson
description:
Jansson, possibly 2.4 and earlier, does not restrict the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted JSON document.


definition_id: oval:org.debian:def:181851096273070782617217933751590137912
title: CVE-2013-6402 hplip
description:
base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.11 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/hp-pkservice.log temporary file.


definition_id: oval:org.debian:def:18546704500620018154534765753154008548
title: CVE-2013-6404 quassel
description:
Quassel core (server daemon) in Quassel IRC before 0.9.2 does not properly verify the user ID when accessing user backlogs, which allows remote authenticated users to read other users' backlogs via the bufferid in (1) 16/select_buffer_by_id.sql, (2) 16/select_buffer_by_id.sql, and (3) 16/select_buffer_by_id.sql in core/SQL/PostgreSQL/.


definition_id: oval:org.debian:def:77797771591168676949142082581700104777
title: CVE-2013-6407 lucene-solr
description:
The UpdateRequestHandler for XML in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:98350644122584991803959726893318399494
title: CVE-2013-6408 lucene-solr
description:
The DocumentAnalysisRequestHandler in Apache Solr before 4.3.1 does not properly use the EmptyEntityResolver, which allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6407.


definition_id: oval:org.debian:def:214341375817373503894469818223217358285
title: CVE-2013-6409 adequate
description:
Debian adequate before 0.8.1, when run by root with the --user option, allows local users to hijack the tty and possibly gain privileges via the TIOCSTI ioctl.


definition_id: oval:org.debian:def:159531670358541190090319700567913166384
title: CVE-2013-6410 nbd
description:
nbd-server in Network Block Device (nbd) before 3.5 does not properly check IP addresses, which might allow remote attackers to bypass intended access restrictions via an IP address that has a partial match in the authfile configuration file.


definition_id: oval:org.debian:def:285130242244560522069219725801073416954
title: CVE-2013-6411 openttd
description:
The HandleCrashedAircraft function in aircraft_cmd.cpp in OpenTTD 0.3.6 through 1.3.2 allows remote attackers to cause a denial of service (out-of-bounds read and crash) by crashing an aircraft outside of the map.


definition_id: oval:org.debian:def:9042948467069579877370778779344651862
title: CVE-2013-6412 augeas
description:
The transform_save function in transform.c in Augeas 1.0.0 through 1.1.0 does not properly calculate the permission values when the umask contains a "7," which causes world-writable permissions to be used for new files and allows local users to modify the files via unspecified vectors.


definition_id: oval:org.debian:def:202187669608012768084629500910180409253
title: CVE-2013-6418 pywbem
description:
PyWBEM 0.7 and earlier uses a separate connection to validate X.509 certificates, which allows man-in-the-middle attackers to spoof a peer via an arbitrary certificate.


definition_id: oval:org.debian:def:235258975924418504399741242962584211380
title: CVE-2013-6419 neutron
description:
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.


definition_id: oval:org.debian:def:221346494694421277233609335569534786287
title: CVE-2013-6422 curl
description:
The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.


definition_id: oval:org.debian:def:137773005365393845409868638490883842880
title: CVE-2013-6426 heat
description:
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.


definition_id: oval:org.debian:def:272492276340976912884760042183378984550
title: CVE-2013-6427 hplip
description:
upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL, which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.


definition_id: oval:org.debian:def:29883797185226925215648572643886585776
title: CVE-2013-6428 heat
description:
The ReST API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 allows remote authenticated users to bypass the tenant scoping restrictions via a modified tenant_id in the request path.


definition_id: oval:org.debian:def:260341464636855696123717440191005048469
title: CVE-2013-6429 libspring-java
description:
The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.


definition_id: oval:org.debian:def:38824768183174786310653198137875319663
title: CVE-2013-6430 libspring-java
description:
The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.


definition_id: oval:org.debian:def:330448983572282547770927743647198692771
title: CVE-2013-6432 linux
description:
The ping_recvmsg function in net/ipv4/ping.c in the Linux kernel before 3.12.4 does not properly interact with read system calls on ping sockets, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging unspecified privileges to execute a crafted application.


definition_id: oval:org.debian:def:119003071962101032535154389745824977416
title: CVE-2013-6433 neutron
description:
The default configuration in the Red Hat openstack-neutron package before 2013.2.3-7 does not properly set a configuration file for rootwrap, which allows remote attackers to gain privileges via a crafted configuration file.


definition_id: oval:org.debian:def:204764029330045632115001186704985833154
title: CVE-2013-6435 rpm
description:
It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation.


definition_id: oval:org.debian:def:24093278761913759496167497151448727441
title: CVE-2013-6436 libvirt
description:
The lxcDomainGetMemoryParameters method in lxc/lxc_driver.c in libvirt 1.0.5 through 1.2.0 does not properly check the status of LXC guests when reading memory tunables, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) via a guest in the shutdown status, as demonstrated by the "virsh memtune" command.


definition_id: oval:org.debian:def:101130945203944706259488373944016948323
title: CVE-2013-6437 nova
description:
The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.


definition_id: oval:org.debian:def:335303353674146453215788752754223109757
title: CVE-2013-6438 apache2
description:
The dav_xml_get_cdata function in main/util.c in the mod_dav module in the Apache HTTP Server before 2.4.8 does not properly remove whitespace characters from CDATA sections, which allows remote attackers to cause a denial of service (daemon crash) via a crafted DAV WRITE request.


definition_id: oval:org.debian:def:70227235863654781082119382845573828785
title: CVE-2013-6441 lxc
description:
The lxc-sshd template (templates/lxc-sshd.in) in LXC before 1.0.0.beta2 uses read-write permissions when mounting /sbin/init, which allows local users to gain privileges by modifying the init file.


definition_id: oval:org.debian:def:95235281242985498256258013772598866212
title: CVE-2013-6442 samba
description:
The owner_set function in smbcacls.c in smbcacls in Samba 4.0.x before 4.0.16 and 4.1.x before 4.1.6 removes an ACL during use of a --chown or --chgrp option, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging an unintended administrative change.


definition_id: oval:org.debian:def:128947044515673915182785287607162253665
title: CVE-2013-6444 pywbem
description:
PyWBEM 0.7 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:173949299722753822210465533928821311153
title: CVE-2013-6449 openssl
description:
The ssl_get_algorithm2 function in ssl/s3_lib.c in OpenSSL before 1.0.2 obtains a certain version number from an incorrect data structure, which allows remote attackers to cause a denial of service (daemon crash) via crafted traffic from a TLS 1.2 client.


definition_id: oval:org.debian:def:55616646038795202477872946122985968217
title: CVE-2013-6450 openssl
description:
The DTLS retransmission implementation in OpenSSL 1.0.0 before 1.0.0l and 1.0.1 before 1.0.1f does not properly maintain data structures for digest and encryption contexts, which might allow man-in-the-middle attackers to trigger the use of a different context and cause a denial of service (application crash) by interfering with packet delivery, related to ssl/d1_both.c and ssl/t1_enc.c.


definition_id: oval:org.debian:def:255309664156497932120033757386108328955
title: CVE-2013-6451 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.


definition_id: oval:org.debian:def:159983147696988708390371607783564258040
title: CVE-2013-6452 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via crafted XSL in an SVG file.


definition_id: oval:org.debian:def:314037567331458229680399858066327790558
title: CVE-2013-6453 mediawiki
description:
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.


definition_id: oval:org.debian:def:237083424820081099490937207907640508145
title: CVE-2013-6454 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via a -o-link attribute.


definition_id: oval:org.debian:def:309488505765548549862137973229469944128
title: CVE-2013-6456 libvirt
description:
The LXC driver (lxc/lxc_driver.c) in libvirt 1.0.1 through 1.2.1 allows local users to (1) delete arbitrary host devices via the virDomainDeviceDettach API and a symlink attack on /dev in the container; (2) create arbitrary nodes (mknod) via the virDomainDeviceAttach API and a symlink attack on /dev in the container; and cause a denial of service (shutdown or reboot host OS) via the (3) virDomainShutdown or (4) virDomainReboot API and a symlink attack on /dev/initctl in the container, related to "paths under /proc/$PID/root" and the virInitctlSetRunLevel function.


definition_id: oval:org.debian:def:328725791252212276616576654836899775437
title: CVE-2013-6457 libvirt
description:
The libxlDomainGetNumaParameters function in the libxl driver (libxl/libxl_driver.c) in libvirt before 1.2.1 does not properly initialize the nodemap, which allows local users to cause a denial of service (invalid free operation and crash) or possibly execute arbitrary code via an inactive domain to the virsh numatune command.


definition_id: oval:org.debian:def:68495366550624405415906803439351070058
title: CVE-2013-6458 libvirt
description:
Multiple race conditions in the (1) virDomainBlockStats, (2) virDomainGetBlockInf, (3) qemuDomainBlockJobImpl, and (4) virDomainGetBlockIoTune functions in libvirt before 1.2.1 do not properly verify that the disk is attached, which allows remote read-only attackers to cause a denial of service (libvirtd crash) via the virDomainDetachDeviceFlags command.


definition_id: oval:org.debian:def:244478925502214228423748241746308078840
title: CVE-2013-6459 ruby-will-paginate
description:
Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links.


definition_id: oval:org.debian:def:203965676212715834556509465501412632857
title: CVE-2013-6462 libxfont
description:
Stack-based buffer overflow in the bdfReadCharacters function in bitmap/bdfread.c in X.Org libXfont 1.1 through 1.4.6 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in a character name in a BDF font file.


definition_id: oval:org.debian:def:151913900276419261957213877082220522150
title: CVE-2013-6472 mediawiki
description:
MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain information about deleted page via the (1) log API, (2) enhanced RecentChanges, and (3) user watchlists.


definition_id: oval:org.debian:def:266398562793653729302390604365053160145
title: CVE-2013-6473 cups-filters
description:
Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.


definition_id: oval:org.debian:def:287857989100135576905899840063990354134
title: CVE-2013-6474 cups
description:
Heap-based buffer overflow in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows remote attackers to execute arbitrary code via a crafted PDF file.


definition_id: oval:org.debian:def:166021668970086173062569805029512375491
title: CVE-2013-6475 cups
description:
Multiple integer overflows in (1) OPVPOutputDev.cxx and (2) oprs/OPVPSplash.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allow remote attackers to execute arbitrary code via a crafted PDF file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:181419486685168965868252213119849493664
title: CVE-2013-6476 cups
description:
The OPVPWrapper::loadDriver function in oprs/OPVPWrapper.cxx in the pdftoopvp filter in CUPS and cups-filters before 1.0.47 allows local users to gain privileges via a Trojan horse driver in the same directory as the PDF file.


definition_id: oval:org.debian:def:79651187654547868598816392645348371205
title: CVE-2013-6477 pidgin
description:
Multiple integer signedness errors in libpurple in Pidgin before 2.10.8 allow remote attackers to cause a denial of service (application crash) via a crafted timestamp value in an XMPP message.


definition_id: oval:org.debian:def:228394001832702038879189636748744812548
title: CVE-2013-6478 pidgin
description:
gtkimhtml.c in Pidgin before 2.10.8 does not properly interact with underlying library support for wide Pango layouts, which allows user-assisted remote attackers to cause a denial of service (application crash) via a long URL that is examined with a tooltip.


definition_id: oval:org.debian:def:38545076350515845187233499394675349017
title: CVE-2013-6479 pidgin
description:
util.c in libpurple in Pidgin before 2.10.8 does not properly allocate memory for HTTP responses that are inconsistent with the Content-Length header, which allows remote HTTP servers to cause a denial of service (application crash) via a crafted response.


definition_id: oval:org.debian:def:91130674469604528037635116205798181061
title: CVE-2013-6481 pidgin
description:
libpurple/protocols/yahoo/libymsg.c in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (crash) via a Yahoo! P2P message with a crafted length field, which triggers a buffer over-read.


definition_id: oval:org.debian:def:246463596555875441183979002844310689136
title: CVE-2013-6482 pidgin
description:
Pidgin before 2.10.8 allows remote MSN servers to cause a denial of service (NULL pointer dereference and crash) via a crafted (1) SOAP response, (2) OIM XML response, or (3) Content-Length header.


definition_id: oval:org.debian:def:63635138583451434810676661472632574506
title: CVE-2013-6483 pidgin
description:
The XMPP protocol plugin in libpurple in Pidgin before 2.10.8 does not properly determine whether the from address in an iq reply is consistent with the to address in an iq request, which allows remote attackers to spoof iq traffic or cause a denial of service (NULL pointer dereference and application crash) via a crafted reply.


definition_id: oval:org.debian:def:41474687615492246137767683419458393514
title: CVE-2013-6484 pidgin
description:
The STUN protocol implementation in libpurple in Pidgin before 2.10.8 allows remote STUN servers to cause a denial of service (out-of-bounds write operation and application crash) by triggering a socket read error.


definition_id: oval:org.debian:def:286313957098942725073429763788191161246
title: CVE-2013-6485 pidgin
description:
Buffer overflow in util.c in libpurple in Pidgin before 2.10.8 allows remote HTTP servers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid chunk-size field in chunked transfer-coding data.


definition_id: oval:org.debian:def:13009875785830209697181851653821705098
title: CVE-2013-6487 libgadu
description:
Integer overflow in libpurple/protocols/gg/lib/http.c in the Gadu-Gadu (gg) parser in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a large Content-Length value, which triggers a buffer overflow.


definition_id: oval:org.debian:def:275804420069600009467511547641913054798
title: CVE-2013-6489 pidgin
description:
Integer signedness error in the MXit functionality in Pidgin before 2.10.8 allows remote attackers to cause a denial of service (segmentation fault) via a crafted emoticon value, which triggers an integer overflow and a buffer overflow.


definition_id: oval:org.debian:def:83581713124459176799237767751955063974
title: CVE-2013-6490 pidgin
description:
The SIMPLE protocol functionality in Pidgin before 2.10.8 allows remote attackers to have an unspecified impact via a negative Content-Length header, which triggers a buffer overflow.


definition_id: oval:org.debian:def:237684162861696692279112981487440010405
title: CVE-2013-6491 nova
description:
The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:210966873795748517769036118926700010792
title: CVE-2013-6493 icedtea-web
description:
The LiveConnect implementation in plugin/icedteanp/IcedTeaNPPlugin.cc in IcedTea-Web before 1.4.2 allows local users to read the messages between a Java applet and a web browser by pre-creating a temporary socket file with a predictable name in /tmp.


definition_id: oval:org.debian:def:88116865414504632897878663670468919972
title: CVE-2013-6497 clamav
description:
clamscan in ClamAV before 0.98.5, when using -a option, allows remote attackers to cause a denial of service (crash) as demonstrated by the jwplayer.js file.


definition_id: oval:org.debian:def:291317658939442712066501600433816228007
title: CVE-2013-6617 salt
description:
The salt master in Salt (aka SaltStack) 0.11.0 through 0.17.0 does not properly drop group privileges, which makes it easier for remote attackers to gain privileges.


definition_id: oval:org.debian:def:51306153330764628716510041231101897067
title: CVE-2013-6629 libjpeg-turbo
description:
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.


definition_id: oval:org.debian:def:106262121690987662500732415598592404907
title: CVE-2013-6630 libjpeg-turbo
description:
The get_dht function in jdmarker.c in libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48 and other products, does not set all elements of a certain Huffman value array during the reading of segments that follow Define Huffman Table (DHT) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.


definition_id: oval:org.debian:def:90446672187464649455098277770225062654
title: CVE-2013-6824 zabbix
description:
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execute arbitrary commands via a newline in a flexible user parameter.


definition_id: oval:org.debian:def:220251750559777491989771385058723710362
title: CVE-2013-6825 dcmtk
description:
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.


definition_id: oval:org.debian:def:46507448211089863822765926705058801017
title: CVE-2013-6832 kfreebsd-10
description:
The nand_ioctl function in sys/dev/nand/nand_geom.c in the nand driver in the kernel in FreeBSD 10 and earlier does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


definition_id: oval:org.debian:def:83548304964050897987193675151848456573
title: CVE-2013-6833 kfreebsd-10
description:
The qls_eioctl function in sys/dev/qlxge/qls_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


definition_id: oval:org.debian:def:313448199110255711326338672871847097265
title: CVE-2013-6834 kfreebsd-10
description:
The ql_eioctl function in sys/dev/qlxgbe/ql_ioctl.c in the kernel in FreeBSD 10 and earlier does not validate a certain size parameter, which allows local users to obtain sensitive information from kernel memory via a crafted ioctl call.


definition_id: oval:org.debian:def:339665414065824061713315277869796677306
title: CVE-2013-6836 gnumeric
description:
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.


definition_id: oval:org.debian:def:339504500818773040142502289862135988230
title: CVE-2013-6858 horizon
description:
Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) "Volumes" or (2) "Network Topology" page.


definition_id: oval:org.debian:def:223185464123174617296234183763081658855
title: CVE-2013-6876 s3d
description:
The (1) pty_init_terminal and (2) pipe_init_terminal functions in main.c in s3dvt 0.2.2 and earlier allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier.  NOTE: this vulnerability was fixed with commit ad732f00b411b092c66a04c359da0f16ec3b387, but the version number was not changed.


definition_id: oval:org.debian:def:333178122204407799071518294634960003009
title: CVE-2013-6888 devscripts
description:
Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.


definition_id: oval:org.debian:def:127723053854478467038295674291919995760
title: CVE-2013-6889 rush
description:
GNU Rush 1.7 does not properly drop privileges, which allows local users to read arbitrary files via the --lint option.


definition_id: oval:org.debian:def:58651906560125841877334169396841679055
title: CVE-2013-6891 cups
description:
lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf.


definition_id: oval:org.debian:def:117779602484190039578630046520030597455
title: CVE-2013-6933 liblivemedia
description:
The parseRTSPRequestString function in Live Networks Live555 Streaming Media 2011.08.13 through 2013.11.25, as used in VideoLAN VLC Media Player, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) space or (2) tab character at the beginning of an RTSP message, which triggers an integer underflow, infinite loop, and buffer overflow.


definition_id: oval:org.debian:def:322423424809466842005446641605027713006
title: CVE-2013-7009 ffmpeg
description:
The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.


definition_id: oval:org.debian:def:16155923570703615830419570587895772979
title: CVE-2013-7010 ffmpeg
description:
Multiple integer signedness errors in libavcodec/dsputil.c in FFmpeg before 2.1 allow remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted data.


definition_id: oval:org.debian:def:310834234962246770288147787292561276725
title: CVE-2013-7011 ffmpeg
description:
The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not prevent changes to global parameters, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.


definition_id: oval:org.debian:def:112676631264161914844108008034789800496
title: CVE-2013-7015 ffmpeg
description:
The flashsv_decode_frame function in libavcodec/flashsv.c in FFmpeg before 2.1 does not properly validate a certain height value, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Flash Screen Video data.


definition_id: oval:org.debian:def:331791701757517298658712146853709767592
title: CVE-2013-7020 ffmpeg
description:
The read_header function in libavcodec/ffv1dec.c in FFmpeg before 2.1 does not properly enforce certain bit-count and colorspace constraints, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted FFV1 data.


definition_id: oval:org.debian:def:75782515531722780700650915098931449555
title: CVE-2013-7026 linux
description:
Multiple race conditions in ipc/shm.c in the Linux kernel before 3.12.2 allow local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted application that uses shmctl IPC_RMID operations in conjunction with other shm system calls.


definition_id: oval:org.debian:def:296293952355260582887264177259528459524
title: CVE-2013-7027 linux
description:
The ieee80211_radiotap_iterator_init function in net/wireless/radiotap.c in the Linux kernel before 3.11.7 does not check whether a frame contains any data outside of the header, which might allow attackers to cause a denial of service (buffer over-read) via a crafted header.


definition_id: oval:org.debian:def:186588668800752421901662081823081715834
title: CVE-2013-7038 libmicrohttpd
description:
The MHD_http_unescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.


definition_id: oval:org.debian:def:43015197078044375988220107534463513217
title: CVE-2013-7039 libmicrohttpd
description:
Stack-based buffer overflow in the MHD_digest_auth_check function in libmicrohttpd before 0.9.32, when MHD_OPTION_CONNECTION_MEMORY_LIMIT is set to a large value, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long URI in an authentication header.


definition_id: oval:org.debian:def:303531839791897735597842476297716206047
title: CVE-2013-7041 pam
description:
The pam_userdb module for Pam uses a case-insensitive method to compare hashed passwords, which makes it easier for attackers to guess the password via a brute force attack.


definition_id: oval:org.debian:def:14728525151181501978195398297815194435
title: CVE-2013-7048 nova
description:
OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.


definition_id: oval:org.debian:def:336864240680285068487645212416631504205
title: CVE-2013-7050 devscripts
description:
The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.


definition_id: oval:org.debian:def:220427958220695505204360703922458265568
title: CVE-2013-7085 devscripts
description:
Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.


definition_id: oval:org.debian:def:99428959305949527135228168303039138036
title: CVE-2013-7098 openconnect
description:
OpenConnect VPN client with GnuTLS before 5.02 contains a heap overflow if MTU is increased on reconnection.


definition_id: oval:org.debian:def:145131926684805646540859718665477862845
title: CVE-2013-7100 asterisk
description:
Buffer overflow in the unpacksms16 function in apps/app_sms.c in Asterisk Open Source 1.8.x before 1.8.24.1, 10.x before 10.12.4, and 11.x before 11.6.1; Asterisk with Digiumphones 10.x-digiumphones before 10.12.4-digiumphones; and Certified Asterisk 1.8.x before 1.8.15-cert4 and 11.x before 11.2-cert3 allows remote attackers to cause a denial of service (daemon crash) via a 16-bit SMS message with an odd number of bytes, which triggers an infinite loop.


definition_id: oval:org.debian:def:327245646590465386912950874947874890480
title: CVE-2013-7106 icinga
description:
Multiple stack-based buffer overflows in Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long string to the (1) display_nav_table, (2) page_limit_selector, (3) print_export_link, or (4) page_num_selector function in cgi/cgiutils.c; (5) status_page_num_selector function in cgi/status.c; or (6) display_command_expansion function in cgi/config.c.  NOTE: this can be exploited without authentication by leveraging CVE-2013-7107.


definition_id: oval:org.debian:def:165532733299475466709811277730517998930
title: CVE-2013-7107 icinga
description:
Cross-site request forgery (CSRF) vulnerability in cmd.cgi in Icinga 1.8.5, 1.9.4, 1.10.2, and earlier allows remote attackers to hijack the authentication of users for unspecified commands via unspecified vectors, as demonstrated by bypassing authentication requirements for CVE-2013-7106.


definition_id: oval:org.debian:def:258765877941283733245313813726748116086
title: CVE-2013-7108 icinga
description:
Multiple off-by-one errors in Nagios Core 3.5.1, 4.0.2, and earlier, and Icinga before 1.8.5, 1.9 before 1.9.4, and 1.10 before 1.10.2 allow remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list to the process_cgivars function in (1) avail.c, (2) cmd.c, (3) config.c, (4) extinfo.c, (5) histogram.c, (6) notifications.c, (7) outages.c, (8) status.c, (9) statusmap.c, (10) summary.c, and (11) trends.c in cgi/, which triggers a heap-based buffer over-read.


definition_id: oval:org.debian:def:217267731048082551681797314567346791340
title: CVE-2013-7110 transifex-client
description:
Transifex command-line client before 0.10 does not validate X.509 certificates for data transfer connections, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-2073.


definition_id: oval:org.debian:def:37670989057850831584947092571750997520
title: CVE-2013-7112 wireshark
description:
The dissect_sip_common function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 does not check for empty lines, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:80429627826577341951491207891741701985
title: CVE-2013-7113 wireshark
description:
epan/dissectors/packet-bssgp.c in the BSSGP dissector in Wireshark 1.10.x before 1.10.4 incorrectly relies on a global variable, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:149098782791641179970259545690221789090
title: CVE-2013-7114 wireshark
description:
Multiple buffer overflows in the create_ntlmssp_v2_key function in epan/dissectors/packet-ntlmssp.c in the NTLMSSP v2 dissector in Wireshark 1.8.x before 1.8.12 and 1.10.x before 1.10.4 allow remote attackers to cause a denial of service (application crash) via a long domain name in a packet.


definition_id: oval:org.debian:def:159584257229709838355360230176810994191
title: CVE-2013-7130 nova
description:
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.


definition_id: oval:org.debian:def:320900154797182880030899547118764140621
title: CVE-2013-7135 libproc-daemon-perl
description:
The Proc::Daemon module 0.14 for Perl uses world-writable permissions for a file that stores a process ID, which allows local users to have an unspecified impact by modifying this file.


definition_id: oval:org.debian:def:238407960565508722739608052040590274865
title: CVE-2013-7176 fail2ban
description:
config/filter.d/postfix.conf in the postfix filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.


definition_id: oval:org.debian:def:311859808641684070317103826459337942160
title: CVE-2013-7177 fail2ban
description:
config/filter.d/cyrus-imap.conf in the cyrus-imap filter in Fail2ban before 0.8.11 allows remote attackers to trigger the blocking of an arbitrary IP address via a crafted e-mail address that matches an improperly designed regular expression.


definition_id: oval:org.debian:def:308581267254432794761071461249580878598
title: CVE-2013-7203 gitolite3
description:
gitolite before commit fa06a34 might allow local users to read arbitrary files in repositories via vectors related to the user umask when running gitolite setup.


definition_id: oval:org.debian:def:317479839983105282115671667946773743712
title: CVE-2013-7220 gnome-shell
description:
js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search.


definition_id: oval:org.debian:def:51168365726241657643155001431496415060
title: CVE-2013-7221 gnome-shell
description:
The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation.


definition_id: oval:org.debian:def:23434063031300418519601906746306026550
title: CVE-2013-7239 memcached
description:
memcached before 1.4.17 allows remote attackers to bypass authentication by sending an invalid request with SASL credentials, then sending another request with incorrect SASL credentials.


definition_id: oval:org.debian:def:26002253294984814299930121905480585151
title: CVE-2013-7252 kde-runtime
description:
kwalletd in KWallet before KDE Applications 14.12.0 uses Blowfish with ECB mode instead of CBC mode when encrypting the password store, which makes it easier for attackers to guess passwords via a codebook attack.


definition_id: oval:org.debian:def:305296647034803552576292269224441270624
title: CVE-2013-7262 mapserver
description:
SQL injection vulnerability in the msPostGISLayerSetTimeFilter function in mappostgis.c in MapServer before 6.4.1, when a WMS-Time service is used, allows remote attackers to execute arbitrary SQL commands via a crafted string in a PostGIS TIME filter.


definition_id: oval:org.debian:def:22395436925723145706643672111715048602
title: CVE-2013-7263 linux
description:
The Linux kernel before 3.12.4 updates certain length values before ensuring that associated data structures have been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call, related to net/ipv4/ping.c, net/ipv4/raw.c, net/ipv4/udp.c, net/ipv6/raw.c, and net/ipv6/udp.c.


definition_id: oval:org.debian:def:322306402205576136660240352912239638123
title: CVE-2013-7264 linux
description:
The l2tp_ip_recvmsg function in net/l2tp/l2tp_ip.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:246082290487873295322345681827524956340
title: CVE-2013-7265 linux
description:
The pn_recvmsg function in net/phonet/datagram.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:127342311143622121396296852430469667134
title: CVE-2013-7266 linux
description:
The mISDN_sock_recvmsg function in drivers/isdn/mISDN/socket.c in the Linux kernel before 3.12.4 does not ensure that a certain length value is consistent with the size of an associated data structure, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:297699792474081358262044498549743103971
title: CVE-2013-7267 linux
description:
The atalk_recvmsg function in net/appletalk/ddp.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:134144862328308579707776747270418142817
title: CVE-2013-7268 linux
description:
The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:133260890003855621783135621380003657432
title: CVE-2013-7269 linux
description:
The nr_recvmsg function in net/netrom/af_netrom.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:125915058032733092223840473665600492446
title: CVE-2013-7270 linux
description:
The packet_recvmsg function in net/packet/af_packet.c in the Linux kernel before 3.12.4 updates a certain length value before ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:214564266953116748032071517831303862552
title: CVE-2013-7271 linux
description:
The x25_recvmsg function in net/x25/af_x25.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:174846990317987456829396971696096268540
title: CVE-2013-7273 gdm3
description:
GNOME Display Manager (gdm) 3.4.1 and earlier, when disable-user-list is set to true, allows local users to cause a denial of service (unable to login) by pressing the cancel button after entering a user name.


definition_id: oval:org.debian:def:340183690676039375655188133673735005960
title: CVE-2013-7281 linux
description:
The dgram_recvmsg function in net/ieee802154/dgram.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel stack memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.


definition_id: oval:org.debian:def:111248933789613743738601837675664574287
title: CVE-2013-7285 libxstream-java
description:
Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.


definition_id: oval:org.debian:def:124850202835060923966122338241462185993
title: CVE-2013-7290 memcached
description:
The do_item_get function in items.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr, a different vulnerability than CVE-2013-0179.


definition_id: oval:org.debian:def:252847369613448710000891452774428739816
title: CVE-2013-7291 memcached
description:
memcached before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (crash) via a request that triggers an "unbounded key print" during logging, related to an issue that was "quickly grepped out of the source tree," a different vulnerability than CVE-2013-0179 and CVE-2013-7290.


definition_id: oval:org.debian:def:204315691540127640831484373750520499856
title: CVE-2013-7295 tor
description:
Tor before 0.2.4.20, when OpenSSL 1.x is used in conjunction with a certain HardwareAccel setting on Intel Sandy Bridge and Ivy Bridge platforms, does not properly generate random numbers for (1) relay identity keys and (2) hidden-service identity keys, which might make it easier for remote attackers to bypass cryptographic protection mechanisms via unspecified vectors.


definition_id: oval:org.debian:def:42515811498643545973197877917479185998
title: CVE-2013-7298 cxxtools
description:
query_params.cpp in cxxtools before 2.2.1 allows remote attackers to cause a denial of service (infinite recursion and crash) via an HTTP query that contains %% (double percent) characters.


definition_id: oval:org.debian:def:46692203899459476865550758337973815262
title: CVE-2013-7299 tntnet
description:
framework/common/messageheaderparser.cpp in Tntnet before 2.2.1 allows remote attackers to obtain sensitive information via a header that ends in \n instead of \r\n, which prevents a null terminator from being added and causes Tntnet to include headers from other requests.


definition_id: oval:org.debian:def:294367584232893392641249057467433820467
title: CVE-2013-7303 spip
description:
Multiple cross-site scripting (XSS) vulnerabilities in (1) squelettes-dist/formulaires/inscription.php and (2) prive/forms/editer_auteur.php in SPIP before 2.1.25 and 3.0.x before 3.0.13 allow remote attackers to inject arbitrary web script or HTML via the author name field.


definition_id: oval:org.debian:def:317301375635814238571734590383790886712
title: CVE-2013-7315 libspring-java
description:
The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152.  NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions.


definition_id: oval:org.debian:def:33445743107770968244680894895362943005
title: CVE-2013-7322 oath-toolkit
description:
usersfile.c in liboath in OATH Toolkit before 2.4.1 does not properly handle lines containing an invalid one-time-password (OTP) type and a user name in /etc/users.oath, which causes the wrong line to be updated when invalidating an OTP and allows context-dependent attackers to conduct replay attacks, as demonstrated by a commented out line when using libpam-oath.


definition_id: oval:org.debian:def:7629542640344193112940680447528534368
title: CVE-2013-7323 python-gnupg
description:
python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.


definition_id: oval:org.debian:def:79918090721616325713342638249761623862
title: CVE-2013-7325 devscripts
description:
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.


definition_id: oval:org.debian:def:133608723898689335584900709151653369862
title: CVE-2013-7329 libcgi-application-perl
description:
The CGI::Application module before 4.50_50 and 4.50_51 for Perl, when run modes are not specified, allows remote attackers to obtain sensitive information (web queries and environment details) via vectors related to the dump_html function.


definition_id: oval:org.debian:def:300744936869256028253591464475885087208
title: CVE-2013-7336 libvirt
description:
The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.


definition_id: oval:org.debian:def:12190200806422706536558698147256475715
title: CVE-2013-7339 linux
description:
The rds_ib_laddr_check function in net/rds/ib.c in the Linux kernel before 3.12.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.


definition_id: oval:org.debian:def:287361358056244769618537868496427187078
title: CVE-2013-7340 vlc
description:
VideoLAN VLC Media Player before 2.0.7 allows remote attackers to cause a denial of service (memory consumption) via a crafted playlist file.


definition_id: oval:org.debian:def:115067276703102920438432447578187889347
title: CVE-2013-7345 file
description:
The BEGIN regular expression in the awk script detector in magic/Magdir/commands in file before 5.15 uses multiple wildcards with unlimited repetitions, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted ASCII file that triggers a large amount of backtracking, as demonstrated via a file with many newline characters.


definition_id: oval:org.debian:def:178239256100858335399366677609787902380
title: CVE-2013-7348 linux
description:
Double free vulnerability in the ioctx_alloc function in fs/aio.c in the Linux kernel before 3.12.4 allows local users to cause a denial of service (system crash) or possibly have unspecified other impact via vectors involving an error condition in the aio_setup_ring function.


definition_id: oval:org.debian:def:185463342445917607948687090685268365518
title: CVE-2013-7353 libpng1.6
description:
Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:216893558239693206448562609871612712480
title: CVE-2013-7354 libpng1.6
description:
Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:223369654625958227808351172849403142750
title: CVE-2013-7386 boinc
description:
Format string vulnerability in the PROJECT::write_account_file function in client/cs_account.cpp in BOINC, possibly 7.2.33, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via format string specifiers in the gui_urls item in an account file.


definition_id: oval:org.debian:def:73939631115459468677161683173684773537
title: CVE-2013-7393 subversion
description:
The daemonize.py module in Subversion 1.8.0 before 1.8.2 allows local users to gain privileges via a symlink attack on the pid file created for (1) svnwcsub.py or (2) irkerbridge.py when the --pidfile option is used.  NOTE: this issue was SPLIT from CVE-2013-4262 based on different affected versions (ADT3).


definition_id: oval:org.debian:def:124484585439495990433003993484098004790
title: CVE-2013-7397 async-http-client
description:
Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.


definition_id: oval:org.debian:def:142067026574821251338744348723610240042
title: CVE-2013-7401 c-icap
description:
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.


definition_id: oval:org.debian:def:299877685827267711639935350286561922581
title: CVE-2013-7402 c-icap
description:
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.


definition_id: oval:org.debian:def:27612557912850120064144820578535697023
title: CVE-2013-7421 linux
description:
The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a module name in the salg_name field, a different vulnerability than CVE-2014-9644.


definition_id: oval:org.debian:def:10487509272634913178041089926027227493
title: CVE-2013-7422 perl
description:
Integer underflow in regcomp.c in Perl before 5.20, as used in Apple OS X before 10.10.5 and other products, allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via a long digit string associated with an invalid backreference within a regular expression.


definition_id: oval:org.debian:def:309290516039868014280943399305874597321
title: CVE-2013-7423 glibc
description:
The send_dg function in resolv/res_send.c in GNU C Library (aka glibc or libc6) before 2.20 does not properly reuse file descriptors, which allows remote attackers to send DNS queries to unintended locations via a large number of requests that trigger a call to the getaddrinfo function.


definition_id: oval:org.debian:def:231961791413521390915556828703071024665
title: CVE-2013-7424 glibc
description:
The getaddrinfo function in glibc before 2.15, when compiled with libidn and the AI_IDN flag is used, allows context-dependent attackers to cause a denial of service (invalid free) and possibly execute arbitrary code via unspecified vectors, as demonstrated by an internationalized domain name to ping6.


definition_id: oval:org.debian:def:91881396291147189007701224688098666875
title: CVE-2013-7436 novnc
description:
noVNC before 0.5 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.


definition_id: oval:org.debian:def:284158275589863598346100401707801439267
title: CVE-2013-7437 potrace
description:
Multiple integer overflows in potrace 1.11 allow remote attackers to cause a denial of service (crash) via large dimensions in a BMP image, which triggers a buffer overflow.


definition_id: oval:org.debian:def:85961234440812936493950967876397097485
title: CVE-2013-7439 libx11
description:
Multiple off-by-one errors in the (1) MakeBigReq and (2) SetReqLen macros in include/X11/Xlibint.h in X11R6.x and libX11 before 1.6.0 allow remote attackers to have unspecified impact via a crafted request, which triggers a buffer overflow.


definition_id: oval:org.debian:def:90751058183527770034816807497701687647
title: CVE-2013-7440 python2.7
description:
The ssl.match_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, which might allow man-in-the-middle attackers to spoof servers via a crafted certificate.


definition_id: oval:org.debian:def:339918555733365199843667315716633089905
title: CVE-2013-7441 nbd
description:
The modern style negotiation in Network Block Device (nbd-server) 2.9.22 through 3.3 allows remote attackers to cause a denial of service (root process termination) by (1) closing the connection during negotiation or (2) specifying a name for a non-existent export.


definition_id: oval:org.debian:def:184375166861674637758906026657451601004
title: CVE-2013-7443 sqlite3
description:
Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements.


definition_id: oval:org.debian:def:91086715520990048300164533638318406307
title: CVE-2013-7444 mediawiki
description:
The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text.


definition_id: oval:org.debian:def:60300462985442471367092431200386183301
title: CVE-2013-7446 linux
description:
Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls.


definition_id: oval:org.debian:def:52640965803030264542581516851965938322
title: CVE-2013-7447 gtk+2.0
description:
Integer overflow in the gdk_cairo_set_source_pixbuf function in gdk/gdkcairo.c in GTK+ before 3.9.8, as used in eom, gnome-photos, eog, gambas3, thunar, pinpoint, and possibly other applications, allows remote attackers to cause a denial of service (crash) via a large image file, which triggers a large memory allocation.


definition_id: oval:org.debian:def:89024090215701690551967523621519686782
title: CVE-2013-7448 didiwiki
description:
Directory traversal vulnerability in wiki.c in didiwiki allows remote attackers to read arbitrary files via the page parameter to api/page/get.


definition_id: oval:org.debian:def:174727525863293018078151475117340307756
title: CVE-2013-7449 hexchat
description:
The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:231408014904620113618189105925270115810
title: CVE-2013-7455 lcms2
description:
Double free vulnerability in the DefaultICCintents function in cmscnvrt.c in liblcms2 in Little CMS 2.x before 2.6 allows remote attackers to execute arbitrary code via a malformed ICC profile that triggers an error in the default intent handler.


definition_id: oval:org.debian:def:217137201928226218897253138628414770479
title: CVE-2013-7456 libgd2
description:
gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.


definition_id: oval:org.debian:def:289955399834230299017051460747341526341
title: CVE-2013-7458 redis
description:
linenoise, as used in Redis before 3.2.3, uses world-readable permissions for .rediscli_history, which allows local users to obtain sensitive information by reading the file.


definition_id: oval:org.debian:def:58708077214900257460102221567373027342
title: CVE-2013-7459 python-crypto
description:
Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.


definition_id: oval:org.debian:def:2667698947415285612843726338537730653
title: CVE-2013-7470 linux
description:
cipso_v4_validate in include/net/cipso_ipv4.h in the Linux kernel before 3.11.7, when CONFIG_NETLABEL is disabled, allows attackers to cause a denial of service (infinite loop and crash), as demonstrated by icmpsic, a different vulnerability than CVE-2013-0310.


definition_id: oval:org.debian:def:277000037508567007875804786032452919158
title: CVE-2013-7490 libdbi-perl
description:
An issue was discovered in the DBI module before 1.632 for Perl. Using many arguments to methods for Callbacks may lead to memory corruption.


definition_id: oval:org.debian:def:5338385697534578221786636855213229812
title: CVE-2013-7491 libdbi-perl
description:
An issue was discovered in the DBI module before 1.628 for Perl. Stack corruption occurs when a user-defined function requires a non-trivial amount of memory and the Perl stack gets reallocated.


definition_id: oval:org.debian:def:197264483668017822083985127930556802486
title: CVE-2014-0006 swift
description:
The TempURL middleware in OpenStack Object Storage (Swift) 1.4.6 through 1.8.0, 1.9.0 through 1.10.0, and 1.11.0 allows remote attackers to obtain secret URLs by leveraging an object name and a timing side-channel attack.


definition_id: oval:org.debian:def:113361183183809598608858356661616018355
title: CVE-2014-0011 vnc4
description:
Multiple heap-based buffer overflows in the ZRLE_DECODE function in common/rfb/zrleDecode.h in TigerVNC before 1.3.1, when NDEBUG is enabled, allow remote VNC servers to cause a denial of service (vncviewer crash) and possibly execute arbitrary code via vectors related to screen image rendering.


definition_id: oval:org.debian:def:30227326682043811060244849748271963139
title: CVE-2014-0012 jinja2
description:
FileSystemBytecodeCache in Jinja2 2.7.2 does not properly create temporary directories, which allows local users to gain privileges by pre-creating a temporary directory with a user's uid.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1402.


definition_id: oval:org.debian:def:316098754950861794671452027249018133567
title: CVE-2014-0015 curl
description:
cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.


definition_id: oval:org.debian:def:18022142999335781375686232897445617558
title: CVE-2014-0017 libssh
description:
The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.


definition_id: oval:org.debian:def:7156557118591268923862987411646515414
title: CVE-2014-0019 socat
description:
Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.


definition_id: oval:org.debian:def:123339656999572580764848913024146984807
title: CVE-2014-0020 pidgin
description:
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.


definition_id: oval:org.debian:def:165309130447303259597577052670266929907
title: CVE-2014-0027 flite
description:
The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:159652363110985032448317267047596163663
title: CVE-2014-0028 libvirt
description:
libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.


definition_id: oval:org.debian:def:44670888610415099425482856963515011764
title: CVE-2014-0032 subversion
description:
The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.


definition_id: oval:org.debian:def:172551490913165414756470822762638160849
title: CVE-2014-0038 linux
description:
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.


definition_id: oval:org.debian:def:277809949482635673108136118425705182241
title: CVE-2014-0039 fwsnort
description:
Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.


definition_id: oval:org.debian:def:81859310893728826635301498787418305331
title: CVE-2014-0044 mumble
description:
The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").


definition_id: oval:org.debian:def:258042638947666203243296246701186133421
title: CVE-2014-0045 mumble
description:
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.


definition_id: oval:org.debian:def:232617729342230329161706734590536821254
title: CVE-2014-0047 docker.io
description:
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.


definition_id: oval:org.debian:def:47704642496933211809266785918122719964
title: CVE-2014-0048 docker.io
description:
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.


definition_id: oval:org.debian:def:24385253513444561492068377739790267262
title: CVE-2014-0049 linux
description:
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.


definition_id: oval:org.debian:def:133184948727229321918954052731660161249
title: CVE-2014-0050 libcommons-fileupload-java
description:
MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.


definition_id: oval:org.debian:def:128205425130085142784553337636079661731
title: CVE-2014-0054 libspring-java
description:
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.


definition_id: oval:org.debian:def:52953448894082898091179752144211481462
title: CVE-2014-0055 linux
description:
The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.


definition_id: oval:org.debian:def:52935187407117455021130819621865863159
title: CVE-2014-0061 postgresql-plsh
description:
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.


definition_id: oval:org.debian:def:331082897913779433841875274249289086916
title: CVE-2014-0069 linux
description:
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.


definition_id: oval:org.debian:def:56842124209388116298288476339008348932
title: CVE-2014-0071 neutron
description:
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.


definition_id: oval:org.debian:def:73885293068588672333215019269424532802
title: CVE-2014-0074 shiro
description:
Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.


definition_id: oval:org.debian:def:122294716841053771867351072057207208396
title: CVE-2014-0076 openssl
description:
The Montgomery ladder implementation in OpenSSL through 1.0.0l does not ensure that certain swap operations have a constant-time behavior, which makes it easier for local users to obtain ECDSA nonces via a FLUSH+RELOAD cache side-channel attack.


definition_id: oval:org.debian:def:144350573235760825981978588349570385866
title: CVE-2014-0077 linux
description:
drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.


definition_id: oval:org.debian:def:10201311702445942721012333520295647721
title: CVE-2014-0081 rails
description:
Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.


definition_id: oval:org.debian:def:65745588598289064388504045527140050567
title: CVE-2014-0082 rails
description:
actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.


definition_id: oval:org.debian:def:185680945239210231420583654443988184937
title: CVE-2014-0092 gnutls28
description:
lib/x509/verify.c in GnuTLS before 3.1.22 and 3.2.x before 3.2.12 does not properly handle unspecified errors when verifying X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


definition_id: oval:org.debian:def:213315387194820529479406681121353252180
title: CVE-2014-0098 apache2
description:
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.


definition_id: oval:org.debian:def:183193741029895484213146243073075357066
title: CVE-2014-0100 linux
description:
Race condition in the inet_frag_intern function in net/ipv4/inet_fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.


definition_id: oval:org.debian:def:280594930970041878241599790971262336534
title: CVE-2014-0101 linux
description:
A flaw was found in the way the Linux kernel processed an authenticated COOKIE_ECHO chunk during the initialization of an SCTP connection. A remote attacker could use this flaw to crash the system by initiating a specially crafted SCTP handshake in order to trigger a NULL pointer dereference on the system.


definition_id: oval:org.debian:def:272448537508450318041943790604932804963
title: CVE-2014-0102 linux
description:
The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.


definition_id: oval:org.debian:def:149502767090938410155856839015709239873
title: CVE-2014-0104 fence-agents
description:
In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-in-the-middle attackers to spoof SSL servers via arbitrary SSL certificates.


definition_id: oval:org.debian:def:262857768320857401908504212123980858385
title: CVE-2014-0105 keystone
description:
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."


definition_id: oval:org.debian:def:8819230940869750357841666154021676201
title: CVE-2014-0106 sudo
description:
Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which allows local users with sudo permissions to bypass intended command restrictions via a crafted environment variable.


definition_id: oval:org.debian:def:225337504706852512476679381191721609816
title: CVE-2014-0107 libxalan2-java
description:
The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.


definition_id: oval:org.debian:def:215005929376342118430617885704551782008
title: CVE-2014-0114 commons-beanutils
description:
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.


definition_id: oval:org.debian:def:131138999551862508957054610999339224839
title: CVE-2014-0117 apache2
description:
The mod_proxy module in the Apache HTTP Server 2.4.x before 2.4.10, when a reverse proxy is enabled, allows remote attackers to cause a denial of service (child-process crash) via a crafted HTTP Connection header.


definition_id: oval:org.debian:def:191439586712704198711004438568882270696
title: CVE-2014-0118 apache2
description:
The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.


definition_id: oval:org.debian:def:231733038571004249947221308100873280514
title: CVE-2014-0131 linux
description:
Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.


definition_id: oval:org.debian:def:161262835828980304455509437858425203026
title: CVE-2014-0133 nginx
description:
Heap-based buffer overflow in the SPDY implementation in nginx 1.3.15 before 1.4.7 and 1.5.x before 1.5.12 allows remote attackers to execute arbitrary code via a crafted request.


definition_id: oval:org.debian:def:130901827270534680630977826510868587738
title: CVE-2014-0134 nova
description:
The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.


definition_id: oval:org.debian:def:86354258117833421513862813850277652280
title: CVE-2014-0138 curl
description:
The default configuration in cURL and libcurl 7.10.6 before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015.


definition_id: oval:org.debian:def:183101025971878704691393170055123345936
title: CVE-2014-0139 curl
description:
cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS, recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:131998345239107105760786219635798988639
title: CVE-2014-0147 qemu
description:
Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by signed data types or a logic error while creating QCOW2 snapshots, which leads to incorrectly calling update_refcount() routine.


definition_id: oval:org.debian:def:146144131955662898902306694240270454576
title: CVE-2014-0148 qemu
description:
Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.


definition_id: oval:org.debian:def:147412796772903247509407969104057248164
title: CVE-2014-0150 qemu
description:
Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:78458467753229967763720507793232168573
title: CVE-2014-0155 linux
description:
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC.  NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.


definition_id: oval:org.debian:def:114625887144233667685585447509740685699
title: CVE-2014-0157 horizon
description:
CVE-2014-0157 openstack-horizon: XSS in Horizon orchestration dashboard when using a malicious template


definition_id: oval:org.debian:def:179661055648877776768358329849666708779
title: CVE-2014-0159 openafs
description:
Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial of service (crash) via a crafted statsVersion argument.


definition_id: oval:org.debian:def:85520910857043432990907255993587026251
title: CVE-2014-0160 openssl
description:
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.


definition_id: oval:org.debian:def:107272656707172906646878221447104537431
title: CVE-2014-0165 wordpress
description:
WordPress before 3.7.2 and 3.8.x before 3.8.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php.


definition_id: oval:org.debian:def:305996816691427816656335823629519824955
title: CVE-2014-0166 wordpress
description:
The wp_validate_auth_cookie function in wp-includes/pluggable.php in WordPress before 3.7.2 and 3.8.x before 3.8.2 does not properly determine the validity of authentication cookies, which makes it easier for remote attackers to obtain access via a forged cookie.


definition_id: oval:org.debian:def:180786167540207585797713142527176742126
title: CVE-2014-0167 nova
description:
It was found that RBAC policies were not enforced in certain methods of the OpenStack Compute EC2 (Amazon Elastic Compute Cloud) API. A remote attacker could use this flaw to escalate their privileges beyond the user group they were originally restricted to. Note that only certain setups using non-default RBAC rules for OpenStack Compute were affected.


definition_id: oval:org.debian:def:101949710902238478479625449603250529982
title: CVE-2014-0172 elfutils
description:
Integer overflow in the check_section function in dwarf_begin_elf.c in the libdw library, as used in elfutils 0.153 and possibly through 0.158 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed compressed debug section in an ELF file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:73489679876132929934331684346001385473
title: CVE-2014-0178 samba
description:
Samba 3.6.6 through 3.6.23, 4.0.x before 4.0.18, and 4.1.x before 4.1.8, when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRV_SNAPSHOT_ARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from process memory via a (1) FSCTL_GET_SHADOW_COPY_DATA or (2) FSCTL_SRV_ENUMERATE_SNAPSHOTS request.


definition_id: oval:org.debian:def:194063211201050851726749367629684865585
title: CVE-2014-0179 libvirt
description:
It was found that libvirt passes the XML_PARSE_NOENT flag when parsing XML documents using the libxml2 library, in which case all XML entities in the parsed documents are expanded. A user able to force libvirtd to parse an XML document with an entity pointing to a file could use this flaw to read the contents of that file (limited to libvirt as shipped with Red Hat Enterprise Linux 7); parsing an XML document with an entity pointing to a special file that blocks on read access could cause libvirtd to hang indefinitely, resulting in a denial of service on the system.


definition_id: oval:org.debian:def:80662543490108983005698726832843668334
title: CVE-2014-0181 linux
description:
The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.


definition_id: oval:org.debian:def:219765493605529830970904663097315752823
title: CVE-2014-0187 neutron
description:
The openvswitch-agent process in OpenStack Neutron 2013.1 before 2013.2.4 and 2014.1 before 2014.1.1 allows remote authenticated users to bypass security group restrictions via an invalid CIDR in a security group rule, which prevents further rules from being applied.


definition_id: oval:org.debian:def:209406559628657288392743812450645249265
title: CVE-2014-0190 qt4-x11
description:
The GIF decoder in QtGui in Qt before 5.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via invalid width and height values in a GIF image.


definition_id: oval:org.debian:def:263830625650149170643150943596054450788
title: CVE-2014-0191 libxml2
description:
The xmlParserHandlePEReference function in parser.c in libxml2 before 2.9.2, as used in Web Listener in Oracle HTTP Server in Oracle Fusion Middleware 11.1.1.7.0, 12.1.2.0, and 12.1.3.0 and other products, loads external parameter entities regardless of whether entity substitution or validation is enabled, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XML document.


definition_id: oval:org.debian:def:100361795582993064537728000939950976528
title: CVE-2014-0195 openssl
description:
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly validate fragment lengths in DTLS ClientHello messages, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a long non-initial fragment.


definition_id: oval:org.debian:def:238624679588080562431574902062360639921
title: CVE-2014-0196 linux
description:
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.


definition_id: oval:org.debian:def:271161086705088756601085302727979498243
title: CVE-2014-0198 openssl
description:
The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.


definition_id: oval:org.debian:def:162308403523667461121510019728368412225
title: CVE-2014-0203 linux
description:
The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.


definition_id: oval:org.debian:def:326896622923898136976289892707803075614
title: CVE-2014-0204 keystone
description:
OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.


definition_id: oval:org.debian:def:3513285554538300888038177117077090377
title: CVE-2014-0205 linux
description:
A flaw was found in the way the Linux kernel's futex subsystem handled reference counting when requeuing futexes during futex_wait(). A local, unprivileged user could use this flaw to zero out the reference counter of an inode or an mm struct that backs up the memory area of the futex, which could lead to a use-after-free flaw, resulting in a system crash or, potentially, privilege escalation.


definition_id: oval:org.debian:def:198251322942378666436352063750922968889
title: CVE-2014-0206 linux
description:
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.


definition_id: oval:org.debian:def:244989432543295144760659745693040679230
title: CVE-2014-0207 file
description:
The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted CDF file.


definition_id: oval:org.debian:def:148824413491299877380512861187415190772
title: CVE-2014-0209 libxfont
description:
Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 might allow local users to gain privileges by adding a directory with a large fonts.dir or fonts.alias file to the font path, which triggers a heap-based buffer overflow, related to metadata.


definition_id: oval:org.debian:def:58006351589254818766621505797320961158
title: CVE-2014-0210 libxfont
description:
Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs protocol reply to the (1) _fs_recv_conn_setup, (2) fs_read_open_font, (3) fs_read_query_info, (4) fs_read_extent_info, (5) fs_read_glyphs, (6) fs_read_list, or (7) fs_read_list_info function.


definition_id: oval:org.debian:def:311494258453138473030587760399252240464
title: CVE-2014-0211 libxfont
description:
Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code via a crafted xfs reply, which triggers a buffer overflow.


definition_id: oval:org.debian:def:17009992505057983542542641733481938767
title: CVE-2014-0221 openssl
description:
The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.


definition_id: oval:org.debian:def:319671490708360022542171359093731226701
title: CVE-2014-0222 qemu
description:
An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.


definition_id: oval:org.debian:def:324778741994810284187223309972766650750
title: CVE-2014-0224 openssl
description:
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.


definition_id: oval:org.debian:def:295421594511054315682671962306941392394
title: CVE-2014-0225 libspring-java
description:
When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.


definition_id: oval:org.debian:def:1258758088017908104374229434755944203
title: CVE-2014-0226 apache2
description:
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.


definition_id: oval:org.debian:def:231240595913561006439287011171401607010
title: CVE-2014-0231 apache2
description:
The mod_cgid module in the Apache HTTP Server before 2.4.10 does not have a timeout mechanism, which allows remote attackers to cause a denial of service (process hang) via a request to a CGI script that does not read from its stdin file descriptor.


definition_id: oval:org.debian:def:214221165497399101114771633987808725962
title: CVE-2014-0236 file
description:
file before 5.18, as used in the Fileinfo component in PHP before 5.6.0, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a zero root_storage value in a CDF file, related to cdf.c and readcdf.c.


definition_id: oval:org.debian:def:167593380362906908607467654406594549424
title: CVE-2014-0237 file
description:
The cdf_unpack_summary_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (performance degradation) by triggering many file_printf calls.


definition_id: oval:org.debian:def:87633563241038025942821770096362937067
title: CVE-2014-0238 file
description:
The cdf_read_property_info function in cdf.c in the Fileinfo component in PHP before 5.4.29 and 5.5.x before 5.5.13 allows remote attackers to cause a denial of service (infinite loop or out-of-bounds memory access) via a vector that (1) has zero length or (2) is too long.


definition_id: oval:org.debian:def:118581578629000041886453619065888280411
title: CVE-2014-0239 samba
description:
The internal DNS server in Samba 4.x before 4.0.18 does not check the QR field in the header section of an incoming DNS message before sending a response, which allows remote attackers to cause a denial of service (CPU and bandwidth consumption) via a forged response packet that triggers a communication loop, a related issue to CVE-1999-0103.


definition_id: oval:org.debian:def:37936047634034287773901313312043996905
title: CVE-2014-0240 mod-wsgi
description:
The mod_wsgi module before 3.5 for Apache, when daemon mode is enabled, does not properly handle error codes returned by setuid when run on certain Linux kernels, which allows local users to gain privileges via vectors related to the number of running processes.


definition_id: oval:org.debian:def:186361598731174551009598357122055135568
title: CVE-2014-0242 mod-wsgi
description:
mod_wsgi module before 3.4 for Apache, when used in embedded mode, might allow remote attackers to obtain sensitive information via the Content-Type header which is generated from memory that may have been freed and then overwritten by a separate thread.


definition_id: oval:org.debian:def:93352772809681554707315247211566546239
title: CVE-2014-0244 samba
description:
The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed UDP packet.


definition_id: oval:org.debian:def:116693670782145846278817697417839754955
title: CVE-2014-0247 libreoffice
description:
It was found that LibreOffice documents executed macros unconditionally, without user approval, when these documents were opened using LibreOffice. An attacker could use this flaw to execute arbitrary code as the user running LibreOffice by embedding malicious VBA scripts in the document as macros.


definition_id: oval:org.debian:def:286843179707937740263560187508651676996
title: CVE-2014-0249 sssd
description:
The System Security Services Daemon (SSSD) 1.11.6 does not properly identify group membership when a non-POSIX group is in a group membership chain, which allows local users to bypass access restrictions via unspecified vectors.


definition_id: oval:org.debian:def:98031228687422251269724043856723636811
title: CVE-2014-0333 libpng1.6
description:
The png_push_read_chunk function in pngpread.c in the progressive decoder in libpng 1.6.x through 1.6.9 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an IDAT chunk with a length of zero.


definition_id: oval:org.debian:def:282779408270754311853928336229114153988
title: CVE-2014-0350 poco
description:
The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.


definition_id: oval:org.debian:def:188727251613119313475434773163221662728
title: CVE-2014-0405 virtualbox-guest-additions-iso
description:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox prior to 3.2.20, 4.0.22, 4.1.30, 4.2.20, and 4.3.4 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core, a different vulnerability than CVE-2014-0407.


definition_id: oval:org.debian:def:90610630924330150734342774352711687652
title: CVE-2014-0459 lcms2
description:
Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE Embedded 7u51, allows remote attackers to affect availability via unknown vectors related to 2D.


definition_id: oval:org.debian:def:88988697754130173838013832986587830139
title: CVE-2014-0466 a2ps
description:
The fixps script in a2ps 4.14 does not use the -dSAFER option when executing gs, which allows context-dependent attackers to delete arbitrary files or execute arbitrary commands via a crafted PostScript file.


definition_id: oval:org.debian:def:197779925177570360755358234491601872224
title: CVE-2014-0467 mutt
description:
Buffer overflow in copy.c in Mutt before 1.5.23 allows remote attackers to cause a denial of service (crash) via a crafted RFC2047 header line, related to address expansion.


definition_id: oval:org.debian:def:2923097456609987759526702209078724828
title: CVE-2014-0469 xbuffy
description:
Stack-based buffer overflow in a certain Debian patch for xbuffy before 3.3.bl.3.dfsg-9 allows remote attackers to execute arbitrary code via the subject of an email, possibly related to indent subject lines.


definition_id: oval:org.debian:def:114281607214170143228205994219495655009
title: CVE-2014-0470 super
description:
super.c in Super 3.30.0 does not check the return value of the setuid function when the -F flag is set, which allows local users to gain privileges via unspecified vectors, aka an RLIMIT_NPROC attack.


definition_id: oval:org.debian:def:240172487214201576216360744177991554178
title: CVE-2014-0471 dpkg
description:
Directory traversal vulnerability in the unpacking functionality in dpkg before 1.15.9, 1.16.x before 1.16.13, and 1.17.x before 1.17.8 allows remote attackers to write arbitrary files via a crafted source package, related to "C-style filename quoting."


definition_id: oval:org.debian:def:93138535555042805894148389634408271101
title: CVE-2014-0472 python-django
description:
The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using user input and a "dotted Python path."


definition_id: oval:org.debian:def:304995709584979755225308828487545161249
title: CVE-2014-0473 python-django
description:
The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protections by reading the CSRF cookie for anonymous users.


definition_id: oval:org.debian:def:217079561749918151111832185362408662440
title: CVE-2014-0474 python-django
description:
The (1) FilePathField, (2) GenericIPAddressField, and (3) IPAddressField model field classes in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 do not properly perform type conversion, which allows remote attackers to have unspecified impact and vectors, related to "MySQL typecasting."


definition_id: oval:org.debian:def:235230580191658612294687067103677172933
title: CVE-2014-0475 glibc
description:
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.


definition_id: oval:org.debian:def:230248670129239621938629801961985490234
title: CVE-2014-0476 chkrootkit
description:
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable.  NOTE: this is only a vulnerability when /tmp is not mounted with the noexec option.


definition_id: oval:org.debian:def:322591965169485238511718617544311321770
title: CVE-2014-0477 libemail-address-perl
description:
The parse function in Email::Address module before 1.905 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via an empty quoted string in an RFC 2822 address.


definition_id: oval:org.debian:def:296593621297172929265682879944909419859
title: CVE-2014-0478 apt
description:
APT before 1.0.4 does not properly validate source packages, which allows man-in-the-middle attackers to download and install Trojan horse packages by removing the Release signature.


definition_id: oval:org.debian:def:340129406160830913504941219581175489061
title: CVE-2014-0479 reportbug
description:
reportbug before 6.4.4+deb7u1 and 6.5.x before 6.5.0+nmu1 allows remote attackers to execute arbitrary commands via vectors related to compare_versions and reportbug/checkversions.py.


definition_id: oval:org.debian:def:1869374927981409711033253890613763478
title: CVE-2014-0480 python-django
description:
The core.urlresolvers.reverse function in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not properly validate URLs, which allows remote attackers to conduct phishing attacks via a // (slash slash) in a URL, which triggers a scheme-relative URL to be generated.


definition_id: oval:org.debian:def:95167476805247817546582028210513597684
title: CVE-2014-0481 python-django
description:
The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name.


definition_id: oval:org.debian:def:267831727016294685116102443143123865376
title: CVE-2014-0482 python-django
description:
The contrib.auth.middleware.RemoteUserMiddleware middleware in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3, when using the contrib.auth.backends.RemoteUserBackend backend, allows remote authenticated users to hijack web sessions via vectors related to the REMOTE_USER header.


definition_id: oval:org.debian:def:33463391890250327209482794596931784661
title: CVE-2014-0483 python-django
description:
The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI.


definition_id: oval:org.debian:def:295764591904392238287221466562420415734
title: CVE-2014-0484 acpi-support
description:
The Debian acpi-support package before 0.140-5+deb7u3 allows local users to gain privileges via vectors related to the "user's environment."


definition_id: oval:org.debian:def:107157574933015483658870055602101557466
title: CVE-2014-0485 s3ql
description:
S3QL 1.18.1 and earlier uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object in (1) common.py or (2) local.py in backends/.


definition_id: oval:org.debian:def:48668891235684297435868636409894631976
title: CVE-2014-0486 knot
description:
Knot DNS before 1.5.2 allows remote attackers to cause a denial of service (application crash) via a crafted DNS message.


definition_id: oval:org.debian:def:126226887312075208745083416873727189638
title: CVE-2014-0487 apt
description:
APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors.


definition_id: oval:org.debian:def:330346475887961085722249195928614426273
title: CVE-2014-0488 apt
description:
APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data.


definition_id: oval:org.debian:def:7031485371367755831403385765971699618
title: CVE-2014-0489 apt
description:
APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package.


definition_id: oval:org.debian:def:285465463997082030623262138282422962714
title: CVE-2014-0490 apt
description:
The apt-get download command in APT before 1.0.9 does not properly validate signatures for packages, which allows remote attackers to execute arbitrary code via a crafted package.


definition_id: oval:org.debian:def:251643176302582817558915672499644016129
title: CVE-2014-0591 bind9
description:
The query_findclosestnsec3 function in query.c in named in ISC BIND 9.6, 9.7, and 9.8 before 9.8.6-P2 and 9.9 before 9.9.4-P2, and 9.6-ESV before 9.6-ESV-R10-P2, allows remote attackers to cause a denial of service (INSIST assertion failure and daemon exit) via a crafted DNS query to an authoritative nameserver that uses the NSEC3 signing feature.


definition_id: oval:org.debian:def:316350154400924404109524468357663089422
title: CVE-2014-0978 graphviz
description:
Stack-based buffer overflow in the yyerror function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via a long line in a dot file.


definition_id: oval:org.debian:def:8475817599392364234632302430947845188
title: CVE-2014-0979 lightdm-gtk-greeter
description:
The start_authentication function in lightdm-gtk-greeter.c in LightDM GTK+ Greeter before 1.7.1 does not properly handle the return value from the lightdm_greeter_get_authentication_user function, which allows local users to cause a denial of service (NULL pointer dereference) via an empty username.


definition_id: oval:org.debian:def:302796494499258553639358704549770081105
title: CVE-2014-0998 kfreebsd-10
description:
Integer signedness error in the vt console driver (formerly Newcons) in FreeBSD 9.3 before p10 and 10.1 before p6 allows local users to cause a denial of service (crash) and possibly gain privileges via a negative value in a VT_WAITACTIVE ioctl call, which triggers an array index error and out-of-bounds kernel memory access.


definition_id: oval:org.debian:def:283520457562897407052741856482018340050
title: CVE-2014-10022 trafficserver
description:
Apache Traffic Server before 5.1.2 allows remote attackers to cause a denial of service via unspecified vectors, related to internal buffer sizing.


definition_id: oval:org.debian:def:224053624686718142441744535534959848137
title: CVE-2014-10064 node-qs
description:
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.


definition_id: oval:org.debian:def:131418196351005059622100334562132436549
title: CVE-2014-10070 zsh
description:
zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as literal numbers). That could allow local privilege escalation, under some specific and atypical conditions where zsh is being invoked in privilege-elevation contexts when the environment has not been properly sanitized, such as when zsh is invoked by sudo on systems where "env_reset" has been disabled.


definition_id: oval:org.debian:def:145314697115010442798104091719020977433
title: CVE-2014-10072 zsh
description:
In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links.


definition_id: oval:org.debian:def:127846467412669910404446889939843604979
title: CVE-2014-10073 psensor
description:
The create_response function in server/server.c in Psensor before 1.1.4 allows Directory Traversal because it lacks a check for whether a file is under the webserver directory.


definition_id: oval:org.debian:def:128330353271938530256967622758222107468
title: CVE-2014-10077 ruby-i18n
description:
Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.


definition_id: oval:org.debian:def:160854552680358189231013966153401912255
title: CVE-2014-10401 libdbi-perl
description:
An issue was discovered in the DBI module before 1.632 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute.


definition_id: oval:org.debian:def:127488530031263485282060573619719821368
title: CVE-2014-10402 libdbi-perl
description:
An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401.


definition_id: oval:org.debian:def:30016028223119715995090741273766427400
title: CVE-2014-1226 s3d
description:
The pipe_init_terminal function in main.c in s3dvt allows local users to gain privileges by leveraging setuid permissions and usage of bash 4.3 and earlier.  NOTE: This vulnerability exists because of an incomplete fix for CVE-2013-6876.


definition_id: oval:org.debian:def:20920047691955199294283085607107761689
title: CVE-2014-1235 graphviz
description:
Stack-based buffer overflow in the "yyerror" function in Graphviz 2.34.0 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted file.  NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-0978.


definition_id: oval:org.debian:def:209321499738953855348761525513808089596
title: CVE-2014-1236 graphviz
description:
Stack-based buffer overflow in the chkNum function in lib/cgraph/scan.l in Graphviz 2.34.0 allows remote attackers to have unspecified impact via vectors related to a "badly formed number" and a "long digit list."


definition_id: oval:org.debian:def:149480619985202163300336420405747710484
title: CVE-2014-125042 network-manager
description:
A vulnerability classified as problematic was found in vicamo NetworkManager. Affected by this vulnerability is the function nm_setting_vlan_add_priority_str/nm_utils_rsa_key_encrypt/nm_setting_vlan_add_priority_str. The manipulation leads to missing release of resource. The name of the patch is afb0e2c53c4c17dfdb89d63b39db5101cc864704. It is recommended to apply a patch to fix this issue. The identifier VDB-217513 was assigned to this vulnerability.


definition_id: oval:org.debian:def:128669070630948001479136823745560393244
title: CVE-2014-125043 network-manager
description:
A vulnerability, which was classified as problematic, has been found in vicamo NetworkManager. Affected by this issue is the function send_arps of the file src/devices/nm-device.c. The manipulation leads to unchecked return value. The name of the patch is 4da19b89815cbf6e063e39bc33c04fe4b3f789df. It is recommended to apply a patch to fix this issue. VDB-217514 is the identifier assigned to this vulnerability.


definition_id: oval:org.debian:def:320303940354759394594956053666120257078
title: CVE-2014-1402 jinja2
description:
The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.


definition_id: oval:org.debian:def:293451196409912444491735865005758561079
title: CVE-2014-1418 python-django
description:
Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly include the (1) Vary: Cookie or (2) Cache-Control header in responses, which allows remote attackers to obtain sensitive information or poison the cache via a request from certain browsers.


definition_id: oval:org.debian:def:90745354171186128869119767676581632044
title: CVE-2014-1419 acpi-support
description:
Race condition in the power policy functions in policy-funcs in acpi-support before 0.142 allows local users to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:247501339778213134755304600268788849181
title: CVE-2014-1425 cgmanager
description:
cmanager 0.32 does not properly enforce nesting when modifying cgroup properties, which allows local users to set cgroup values for all cgroups via unspecified vectors.


definition_id: oval:org.debian:def:144681092762076503792415947900614433008
title: CVE-2014-1438 linux
description:
The restore_fpu_checking function in arch/x86/include/asm/fpu-internal.h in the Linux kernel before 3.12.8 on the AMD K7 and K8 platforms does not clear pending exceptions before proceeding to an EMMS instruction, which allows local users to cause a denial of service (task kill) or possibly gain privileges via a crafted application.


definition_id: oval:org.debian:def:83991690392387299665088506522295285306
title: CVE-2014-1444 linux
description:
The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.


definition_id: oval:org.debian:def:63199387011375514151287721379000560541
title: CVE-2014-1445 linux
description:
The wanxl_ioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.


definition_id: oval:org.debian:def:183556688468137346333632902012218540282
title: CVE-2014-1446 linux
description:
The yam_ioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCYAMGCFG ioctl call.


definition_id: oval:org.debian:def:70870519975903909968311497529302775292
title: CVE-2014-1447 libvirt
description:
Race condition in the virNetServerClientStartKeepAlive function in libvirt before 1.2.1 allows remote attackers to cause a denial of service (libvirtd crash) by closing a connection before a keepalive response is sent.


definition_id: oval:org.debian:def:106385431160583738124245085810854234210
title: CVE-2014-1453 kfreebsd-10
description:
The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.


definition_id: oval:org.debian:def:334086788015157842810452562362550944719
title: CVE-2014-1471 otrs2
description:
SQL injection vulnerability in the StateGetStatesByType function in Kernel/System/State.pm in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allows remote attackers to execute arbitrary SQL commands via vectors related to a ticket search URL.


definition_id: oval:org.debian:def:218645906765902191885810782994765765411
title: CVE-2014-1474 libemail-address-list-perl
description:
Algorithmic complexity vulnerability in Email::Address::List before 0.02, as used in RT 4.2.0 through 4.2.2, allows remote attackers to cause a denial of service (CPU consumption) via a string without an address.


definition_id: oval:org.debian:def:152760551143240570050458226985865640070
title: CVE-2014-1490 nss
description:
Race condition in libssl in Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors involving a resumption handshake that triggers incorrect replacement of a session ticket.


definition_id: oval:org.debian:def:54921751632117941908573950225733286534
title: CVE-2014-1491 nss
description:
Mozilla Network Security Services (NSS) before 3.15.4, as used in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, SeaMonkey before 2.24, and other products, does not properly restrict public values in Diffie-Hellman key exchanges, which makes it easier for remote attackers to bypass cryptographic protection mechanisms in ticket handling by leveraging use of a certain value.


definition_id: oval:org.debian:def:210791627906943418099551760816244813854
title: CVE-2014-1492 nss
description:
The cert_TestHostName function in lib/certdb/certdb.c in the certificate-checking implementation in Mozilla Network Security Services (NSS) before 3.16 accepts a wildcard character that is embedded in an internationalized domain name's U-label, which might allow man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


definition_id: oval:org.debian:def:49699315073611203190718035431633952847
title: CVE-2014-1544 nss
description:
Use-after-free vulnerability in the CERT_DestroyCertificate function in libnss3.so in Mozilla Network Security Services (NSS) 3.x, as used in Firefox before 31.0, Firefox ESR 24.x before 24.7, and Thunderbird before 24.7, allows remote attackers to execute arbitrary code via vectors that trigger certain improper removal of an NSSCertificate structure from a trust domain.


definition_id: oval:org.debian:def:136204493724214595466068692370031024180
title: CVE-2014-1545 nspr
description:
Mozilla Netscape Portable Runtime (NSPR) before 4.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via vectors involving the sprintf and console functions.


definition_id: oval:org.debian:def:109449155295883079264849849639591962205
title: CVE-2014-1568 nss
description:
Mozilla Network Security Services (NSS) before 3.16.2.1, 3.16.x before 3.16.5, and 3.17.x before 3.17.1, as used in Mozilla Firefox before 32.0.3, Mozilla Firefox ESR 24.x before 24.8.1 and 31.x before 31.1.1, Mozilla Thunderbird before 24.8.1 and 31.x before 31.1.2, Mozilla SeaMonkey before 2.29.1, Google Chrome before 37.0.2062.124 on Windows and OS X, and Google Chrome OS before 37.0.2062.120, does not properly parse ASN.1 values in X.509 certificates, which makes it easier for remote attackers to spoof RSA signatures via a crafted certificate, aka a "signature malleability" issue.


definition_id: oval:org.debian:def:200454956788694115284844636487388328072
title: CVE-2014-1569 nss
description:
The definite_length_decoder function in lib/util/quickder.c in Mozilla Network Security Services (NSS) before 3.16.2.4 and 3.17.x before 3.17.3 does not ensure that the DER encoding of an ASN.1 length is properly formed, which allows remote attackers to conduct data-smuggling attacks by using a long byte sequence for an encoding, as demonstrated by the SEC_QuickDERDecodeItem function's improper handling of an arbitrary-length encoding of 0x00.


definition_id: oval:org.debian:def:7834037255978688751203378797431061672
title: CVE-2014-1578 libvpx
description:
The get_tile function in Mozilla Firefox before 33.0, Firefox ESR 31.x before 31.2, and Thunderbird 31.x before 31.2 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly execute arbitrary code via WebM frames with invalid tile sizes that are improperly handled in buffering operations during video playback.


definition_id: oval:org.debian:def:69176170304723227214802227634515976449
title: CVE-2014-1604 python-rply
description:
The parser cache functionality in parsergenerator.py in RPLY (aka python-rply) before 0.7.1 allows local users to spoof cache data by pre-creating a temporary rply-*.json file with a predictable name.


definition_id: oval:org.debian:def:51906984573595817324119845996322773137
title: CVE-2014-1610 mediawiki
description:
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.


definition_id: oval:org.debian:def:41475202633713305244541676328141464122
title: CVE-2014-1624 pyxdg
description:
Race condition in the xdg.BaseDirectory.get_runtime_dir function in python-xdg 0.25 allows local users to overwrite arbitrary files by pre-creating /tmp/pyxdg-runtime-dir-fallback-victim to point to a victim-owned location, then replacing it with a symlink to an attacker-controlled location once the get_runtime_dir function is called.


definition_id: oval:org.debian:def:255164928680332828105618924035226607867
title: CVE-2014-1626 libmarc-xml-perl
description:
XML External Entity (XXE) vulnerability in MARC::File::XML module before 1.0.2 for Perl, as used in Evergreen, Koha, perl4lib, and possibly other products, allows context-dependent attackers to read arbitrary files via a crafted XML file.


definition_id: oval:org.debian:def:60063599795059741768906472996192985695
title: CVE-2014-1638 localepurge
description:
(1) debian/postrm and (2) debian/localepurge.config in localepurge before 0.7.3.2 use tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.


definition_id: oval:org.debian:def:231057538190784961142145940909594016676
title: CVE-2014-1639 syncevolution
description:
syncevo/installcheck-local.sh in syncevolution before 1.3.99.7 uses mktemp to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.


definition_id: oval:org.debian:def:295364204723031580931933504977629354408
title: CVE-2014-1640 axiom
description:
axiom-test.sh in axiom 20100701-1.1 uses tempfile to create a safe temporary file but appends a suffix to the original filename and writes to this new filename, which allows local users to overwrite arbitrary files via a symlink attack on the new filename.


definition_id: oval:org.debian:def:53158766745772439984747559949066711089
title: CVE-2014-1642 xen
description:
The IRQ setup in Xen 4.2.x and 4.3.x, when using device passthrough and configured to support a large number of CPUs, frees certain memory that may still be intended for use, which allows local guest administrators to cause a denial of service (memory corruption and hypervisor crash) and possibly execute arbitrary code via vectors related to an out-of-memory error that triggers a (1) use-after-free or (2) double free.


definition_id: oval:org.debian:def:179135339581133509750833129869927560442
title: CVE-2014-1666 xen
description:
The do_physdev_op function in Xen 4.1.5, 4.1.6.1, 4.2.2 through 4.2.3, and 4.3.x does not properly restrict access to the (1) PHYSDEVOP_prepare_msix and (2) PHYSDEVOP_release_msix operations, which allows local PV guests to cause a denial of service (host or guest malfunction) or possibly gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:225102897177891469704423793703893927171
title: CVE-2014-1682 zabbix
description:
The API in Zabbix before 1.8.20rc1, 2.0.x before 2.0.11rc1, and 2.2.x before 2.2.2rc1 allows remote authenticated users to spoof arbitrary users via the user name in a user.login request.


definition_id: oval:org.debian:def:13652541590855324750973807191518354086
title: CVE-2014-1684 vlc
description:
The ASF_ReadObject_file_properties function in modules/demux/asf/libasf.c in the ASF Demuxer in VideoLAN VLC Media Player before 2.1.3 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a zero minimum and maximum data packet size in an ASF file.


definition_id: oval:org.debian:def:148644943115057874068543216044116403954
title: CVE-2014-1685 zabbix
description:
The Frontend in Zabbix before 1.8.20rc2, 2.0.x before 2.0.11rc2, and 2.2.x before 2.2.2rc1 allows remote "Zabbix Admin" users to modify the media of arbitrary users via unspecified vectors.


definition_id: oval:org.debian:def:19407989219462698865977599810123997948
title: CVE-2014-1690 linux
description:
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.


definition_id: oval:org.debian:def:122679865488160041299998107500768881093
title: CVE-2014-1691 php-horde-util
description:
The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.


definition_id: oval:org.debian:def:321546253315639286311241053642431381870
title: CVE-2014-1693 erlang
description:
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.


definition_id: oval:org.debian:def:288953973647385588566111619713109577585
title: CVE-2014-1694 otrs2
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in (1) CustomerPreferences.pm, (2) CustomerTicketMessage.pm, (3) CustomerTicketProcess.pm, and (4) CustomerTicketZoom.pm in Kernel/Modules/ in Open Ticket Request System (OTRS) 3.1.x before 3.1.19, 3.2.x before 3.2.14, and 3.3.x before 3.3.4 allow remote attackers to hijack the authentication of arbitrary users for requests that (5) create tickets or (6) send follow-ups to existing tickets.


definition_id: oval:org.debian:def:305548122618243907351299018435604028611
title: CVE-2014-1695 otrs2
description:
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.20, 3.2.x before 3.2.15, and 3.3.x before 3.3.5 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML email.


definition_id: oval:org.debian:def:61453815904061403475174825910398247578
title: CVE-2014-1724 speech-dispatcher
description:
Use-after-free vulnerability in Free(b)soft Laboratory Speech Dispatcher 0.7.1, as used in Google Chrome before 34.0.1847.116, allows remote attackers to cause a denial of service (application hang) or possibly have unspecified other impact via a text-to-speech request.


definition_id: oval:org.debian:def:253218487830147638170596858735495067314
title: CVE-2014-1737 linux
description:
The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.


definition_id: oval:org.debian:def:183857769662920921768943347708154078736
title: CVE-2014-1738 linux
description:
The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.


definition_id: oval:org.debian:def:323723392188053454096561905433492927041
title: CVE-2014-1739 linux
description:
The media_device_enum_entities function in drivers/media/media-device.c in the Linux kernel before 3.14.6 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging /dev/media0 read access for a MEDIA_IOC_ENUM_ENTITIES ioctl call.


definition_id: oval:org.debian:def:330499933183126599363295105315214253891
title: CVE-2014-1829 requests
description:
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain a netrc password by reading the Authorization header in a redirected request.


definition_id: oval:org.debian:def:288117221642243729930088699575128639432
title: CVE-2014-1830 requests
description:
Requests (aka python-requests) before 2.3.0 allows remote servers to obtain sensitive information by reading the Proxy-Authorization header in a redirected request.


definition_id: oval:org.debian:def:232609213858290033723785946711208418253
title: CVE-2014-1831 passenger
description:
Phusion Passenger before 4.0.37 allows local users to write to certain files and directories via a symlink attack on (1) control_process.pid or a (2) generation-* file.


definition_id: oval:org.debian:def:139083904881662194635583632829498039924
title: CVE-2014-1833 devscripts
description:
Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.


definition_id: oval:org.debian:def:65990117573950523803750820788479488716
title: CVE-2014-1838 logilab-common
description:
The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.


definition_id: oval:org.debian:def:241762463814217108076316879082931057382
title: CVE-2014-1839 logilab-common
description:
The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.


definition_id: oval:org.debian:def:42905753791941270639042628570970407322
title: CVE-2014-1845 e17
description:
An unspecified setuid root helper in Enlightenment before 0.17.6 allows local users to gain privileges by leveraging failure to properly sanitize the environment.


definition_id: oval:org.debian:def:88900335822266465229542425893584105909
title: CVE-2014-1846 e17
description:
Enlightenment before 0.17.6 might allow local users to gain privileges via vectors involving the gdb method.


definition_id: oval:org.debian:def:28290827661056056130449032934713123527
title: CVE-2014-1858 python-numpy
description:
__init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:185567349450357613564267206402392529316
title: CVE-2014-1859 python-numpy
description:
(1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:284496479791141376482823217457817196511
title: CVE-2014-1874 linux
description:
The security_context_to_sid_core function in security/selinux/ss/services.c in the Linux kernel before 3.13.4 allows local users to cause a denial of service (system crash) by leveraging the CAP_MAC_ADMIN capability to set a zero-length security context.


definition_id: oval:org.debian:def:198278263588913948154753395374296006543
title: CVE-2014-1875 libcapture-tiny-perl
description:
The Capture::Tiny module before 0.24 for Perl allows local users to write to arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:44226510816240114539504682011050005403
title: CVE-2014-1878 icinga
description:
Stack-based buffer overflow in the cmd_submitf function in cgi/cmd.c in Nagios Core, possibly 4.0.3rc1 and earlier, and Icinga before 1.8.6, 1.9 before 1.9.5, and 1.10 before 1.10.3 allows remote attackers to cause a denial of service (segmentation fault) via a long message to cmd.cgi.


definition_id: oval:org.debian:def:329518226399128099957685079572062584252
title: CVE-2014-1895 xen
description:
Off-by-one error in the flask_security_avc_cachestats function in xsm/flask/flask_op.c in Xen 4.2.x and 4.3.x, when the maximum number of physical CPUs are in use, allows local users to cause a denial of service (host crash) or obtain sensitive information from hypervisor memory by leveraging a FLASK_AVC_CACHESTAT hypercall, which triggers a buffer over-read.


definition_id: oval:org.debian:def:27999390998760482608418712429836696431
title: CVE-2014-1896 xen
description:
The (1) do_send and (2) do_recv functions in io.c in libvchan in Xen 4.2.x, 4.3.x, and 4.4-RC series allows local guests to cause a denial of service or possibly gain privileges via crafted xenstore ring indexes, which triggers a "read or write past the end of the ring."


definition_id: oval:org.debian:def:78812109288443784654249389152968680620
title: CVE-2014-1904 libspring-java
description:
Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.


definition_id: oval:org.debian:def:315593712621040882838085486615228430238
title: CVE-2014-1909 android-platform-system-core
description:
Integer signedness error in system/core/adb/adb_client.c in Android Debug Bridge (ADB) for Android 4.4 in the Android SDK Platform Tools 18.0.1 allows ADB servers to execute arbitrary code via a negative length value, which bypasses a signed comparison and triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:60311498478729511628249595893093009161
title: CVE-2014-1912 python2.7
description:
Buffer overflow in the socket.recvfrom_into function in Modules/socketmodule.c in Python 2.5 before 2.7.7, 3.x before 3.3.4, and 3.4.x before 3.4rc1 allows remote attackers to execute arbitrary code via a crafted string.


definition_id: oval:org.debian:def:228327961086206283942674242375875829778
title: CVE-2014-1921 parcimonie
description:
parcimonie before 0.8.1, when using a large keyring, sleeps for the same amount of time between fetches, which allows attackers to correlate key fetches via unspecified vectors.


definition_id: oval:org.debian:def:325229509080935249413942529957314910679
title: CVE-2014-1927 python-gnupg
description:
The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "$(" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


definition_id: oval:org.debian:def:133505545697405435743756609088821180109
title: CVE-2014-1928 python-gnupg
description:
The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using "\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


definition_id: oval:org.debian:def:83048119544713051260764207837206560708
title: CVE-2014-1929 python-gnupg
description:
python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to "option injection through positional arguments." NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.


definition_id: oval:org.debian:def:289922438762435994586916742452935508407
title: CVE-2014-1932 pillow
description:
The (1) load_djpeg function in JpegImagePlugin.py, (2) Ghostscript function in EpsImagePlugin.py, (3) load function in IptcImagePlugin.py, and (4) _copy function in Image.py in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 do not properly create temporary files, which allow local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on the temporary file.


definition_id: oval:org.debian:def:153471046863467206029101609217349725459
title: CVE-2014-1933 pillow
description:
The (1) JpegImagePlugin.py and (2) EpsImagePlugin.py scripts in Python Image Library (PIL) 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes.


definition_id: oval:org.debian:def:312899284297503258498976159697331110494
title: CVE-2014-1934 eyed3
description:
tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:253475021067234373946001916190193415910
title: CVE-2014-1943 file
description:
Fine Free file before 5.17 allows context-dependent attackers to cause a denial of service (infinite recursion, CPU consumption, and crash) via a crafted indirect offset value in the magic of a file.


definition_id: oval:org.debian:def:205334662363074839481444917186957263700
title: CVE-2014-1947 graphicsmagick
description:
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick 6.5.4 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of layers in a PSD image, involving the L%02ld string, a different vulnerability than CVE-2014-2030.


definition_id: oval:org.debian:def:145234943812780893055612423860209433438
title: CVE-2014-1948 glance
description:
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.


definition_id: oval:org.debian:def:302466716449281563090730798425572384826
title: CVE-2014-1949 cinnamon
description:
GTK+ 3.10.9 and earlier, as used in cinnamon-screensaver, gnome-screensaver, and other applications, allows physically proximate attackers to bypass the lock screen by pressing the menu button.


definition_id: oval:org.debian:def:38639658961096644161988757614400278014
title: CVE-2014-1950 xen
description:
Use-after-free vulnerability in the xc_cpupool_getinfo function in Xen 4.1.x through 4.3.x, when using a multithreaded toolstack, does not properly handle a failure by the xc_cpumap_alloc function, which allows local users with access to management functions to cause a denial of service (heap corruption) and possibly gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:182247252852813860539587268695684399663
title: CVE-2014-1958 imagemagick
description:
Buffer overflow in the DecodePSDPixels function in coders/psd.c in ImageMagick before 6.8.8-5 might allow remote attackers to execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-2030.


definition_id: oval:org.debian:def:300050700105801648307797125764478026876
title: CVE-2014-1959 gnutls28
description:
lib/x509/verify.c in GnuTLS before 3.1.21 and 3.2.x before 3.2.11 treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates.


definition_id: oval:org.debian:def:229456833303173293610843635705589123723
title: CVE-2014-2013 mupdf
description:
Stack-based buffer overflow in the xps_parse_color function in xps/xps-common.c in MuPDF 1.3 and earlier allows remote attackers to execute arbitrary code via a large number of entries in the ContextColor value of the Fill attribute in a Path element.


definition_id: oval:org.debian:def:217789727485833637543498540273522518619
title: CVE-2014-2015 freeradius
description:
Stack-based buffer overflow in the normify function in the rlm_pap module (modules/rlm_pap/rlm_pap.c) in FreeRADIUS 2.x, possibly 2.2.3 and earlier, and 3.x, possibly 3.0.1 and earlier, might allow attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long password hash, as demonstrated by an SSHA hash.


definition_id: oval:org.debian:def:255189970134545688215298102175556964850
title: CVE-2014-2029 percona-toolkit
description:
The automatic version check functionality in the tools in Percona Toolkit 2.1 allows man-in-the-middle attackers to obtain sensitive information or execute arbitrary code by leveraging use of HTTP to download configuration information from v.percona.com.


definition_id: oval:org.debian:def:242752084448972630407031161301532830601
title: CVE-2014-2030 imagemagick
description:
Stack-based buffer overflow in the WritePSDImage function in coders/psd.c in ImageMagick, possibly 6.8.8-5, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PSD image, involving the L%06ld string, a different vulnerability than CVE-2014-1947.


definition_id: oval:org.debian:def:94859427567599302134509348771927964078
title: CVE-2014-2038 linux
description:
The nfs_can_extend_write function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.


definition_id: oval:org.debian:def:90911562013098749049848565398181450314
title: CVE-2014-2039 linux
description:
arch/s390/kernel/head64.S in the Linux kernel before 3.13.5 on the s390 platform does not properly handle attempted use of the linkage stack, which allows local users to cause a denial of service (system crash) by executing a crafted instruction.


definition_id: oval:org.debian:def:214754746135129907918337428108331319743
title: CVE-2014-2053 php-getid3
description:
getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.


definition_id: oval:org.debian:def:61111743955622838123774262463126110624
title: CVE-2014-2055 php-sabredav
description:
SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.


definition_id: oval:org.debian:def:108013547595167297334638456744278469543
title: CVE-2014-2079 xfe
description:
X File Explorer (aka xfe) might allow local users to bypass intended access restrictions and gain access to arbitrary files by leveraging failure to use directory masks when creating files on Samba and NFS shares.


definition_id: oval:org.debian:def:97552494241738745713088467666077634680
title: CVE-2014-2093 catfish
description:
Untrusted search path vulnerability in Catfish through 0.4.0.3 allows local users to gain privileges via a Trojan horse catfish.py in the current working directory.


definition_id: oval:org.debian:def:207495263914518109886357085704840988697
title: CVE-2014-2094 catfish
description:
Untrusted search path vulnerability in Catfish through 0.4.0.3, when a Fedora package such as 0.4.0.2-2 is not used, allows local users to gain privileges via a Trojan horse catfish.pyc in the current working directory.


definition_id: oval:org.debian:def:59480818300725642798421690826972152883
title: CVE-2014-2095 catfish
description:
Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0, when a Fedora package such as 0.8.2-1 is not used, allows local users to gain privileges via a Trojan horse bin/catfish.pyc under the current working directory.


definition_id: oval:org.debian:def:318548591181719576657164418115971319783
title: CVE-2014-2096 catfish
description:
Untrusted search path vulnerability in Catfish 0.6.0 through 1.0.0 allows local users to gain privileges via a Trojan horse bin/catfish.py under the current working directory.


definition_id: oval:org.debian:def:230124819836204041865153960505982393825
title: CVE-2014-2237 keystone
description:
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.


definition_id: oval:org.debian:def:236954988882846639382857962252106585146
title: CVE-2014-2240 freetype
description:
Stack-based buffer overflow in the cf2_hintmap_build function in cff/cf2hints.c in FreeType before 2.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of stem hints in a font file.


definition_id: oval:org.debian:def:206375715944947895031566439219855756851
title: CVE-2014-2241 freetype
description:
The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegionBuffer functions in cff/cf2ft.c in FreeType before 2.5.3 do not properly check if a subroutine exists, which allows remote attackers to cause a denial of service (assertion failure), as demonstrated by a crafted ttf file.


definition_id: oval:org.debian:def:229440432238917468950313255614178779756
title: CVE-2014-2242 mediawiki
description:
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.


definition_id: oval:org.debian:def:235320832489613718082777784977586899137
title: CVE-2014-2243 mediawiki
description:
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.


definition_id: oval:org.debian:def:50639884263823520400752432154267805730
title: CVE-2014-2263 ffmpeg
description:
The mpegts_write_pmt function in the MPEG2 transport stream (aka DVB) muxer (libavformat/mpegtsenc.c) in FFmpeg, possibly 2.1 and earlier, allows remote attackers to have unspecified impact and vectors, which trigger an out-of-bounds write.


definition_id: oval:org.debian:def:194298651528397049812536648288325646896
title: CVE-2014-2270 file
description:
softmagic.c in file before 5.17 and libmagic allows context-dependent attackers to cause a denial of service (out-of-bounds memory access and crash) via crafted offsets in the softmagic of a PE executable.


definition_id: oval:org.debian:def:242225018650544527896606687338765272824
title: CVE-2014-2277 perltidy
description:
The make_temporary_filename function in perltidy 20120701-1 and earlier allows local users to obtain sensitive information or write to arbitrary files via a symlink attack, related to use of the tmpnam function.


definition_id: oval:org.debian:def:121206582838138770067112834132649633393
title: CVE-2014-2281 wireshark
description:
The nfs_name_snoop_add_name function in epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 does not validate a certain length value, which allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted NFS packet.


definition_id: oval:org.debian:def:108595589865071883009995823830411544018
title: CVE-2014-2282 wireshark
description:
The dissect_protocol_data_parameter function in epan/dissectors/packet-m3ua.c in the M3UA dissector in Wireshark 1.10.x before 1.10.6 does not properly allocate memory, which allows remote attackers to cause a denial of service (application crash) via a crafted SS7 MTP3 packet.


definition_id: oval:org.debian:def:181680724507563896242134304033392024959
title: CVE-2014-2283 wireshark
description:
epan/dissectors/packet-rlc in the RLC dissector in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 uses inconsistent memory-management approaches, which allows remote attackers to cause a denial of service (use-after-free error and application crash) via a crafted UMTS Radio Link Control packet.


definition_id: oval:org.debian:def:163433891552002417431693717226106748081
title: CVE-2014-2284 net-snmp
description:
The Linux implementation of the ICMP-MIB in Net-SNMP 5.5 before 5.5.2.1, 5.6.x before 5.6.2.1, and 5.7.x before 5.7.2.1 does not properly validate input, which allows remote attackers to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:152672168831715134490149327840659366221
title: CVE-2014-2285 net-snmp
description:
The perl_trapd_handler function in perl/TrapReceiver/TrapReceiver.xs in Net-SNMP 5.7.3.pre3 and earlier, when using certain Perl versions, allows remote attackers to cause a denial of service (snmptrapd crash) via an empty community string in an SNMP trap, which triggers a NULL pointer dereference within the newSVpv function in Perl.


definition_id: oval:org.debian:def:322125291040912138117839886584680299447
title: CVE-2014-2286 asterisk
description:
main/http.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.x before 1.8.15-cert5 and 11.6 before 11.6-cert2, allows remote attackers to cause a denial of service (stack consumption) and possibly execute arbitrary code via an HTTP request with a large number of Cookie headers.


definition_id: oval:org.debian:def:288594431496675651608024005230459356063
title: CVE-2014-2287 asterisk
description:
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.26.1, 11.8.x before 11.8.1, and 12.1.x before 12.1.1, and Certified Asterisk 1.8.15 before 1.8.15-cert5 and 11.6 before 11.6-cert2, when chan_sip has a certain configuration, allows remote authenticated users to cause a denial of service (channel and file descriptor consumption) via an INVITE request with a (1) Session-Expires or (2) Min-SE header with a malformed or invalid value.


definition_id: oval:org.debian:def:206243142648666636858550331400643679241
title: CVE-2014-2299 wireshark
description:
Buffer overflow in the mpeg_read function in wiretap/mpeg.c in the MPEG parser in Wireshark 1.8.x before 1.8.13 and 1.10.x before 1.10.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large record in MPEG data.


definition_id: oval:org.debian:def:176812574510900600205175225404301591791
title: CVE-2014-2309 linux
description:
The ip6_route_add function in net/ipv6/route.c in the Linux kernel through 3.13.6 does not properly count the addition of routes, which allows remote attackers to cause a denial of service (memory consumption) via a flood of ICMPv6 Router Advertisement packets.


definition_id: oval:org.debian:def:145630343617459731270096628437182007790
title: CVE-2014-2310 net-snmp
description:
The AgentX subagent in Net-SNMP before 5.4.4 allows remote attackers to cause a denial of service (hang) by sending a multi-object request with an Object ID (OID) containing more subids than previous requests, a different vulnerability than CVE-2012-6151.


definition_id: oval:org.debian:def:152268476721059136840988324793087357138
title: CVE-2014-2323 lighttpd
description:
SQL injection vulnerability in mod_mysql_vhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name, related to request_check_hostname.


definition_id: oval:org.debian:def:200275908535211928623173768646066803288
title: CVE-2014-2324 lighttpd
description:
Multiple directory traversal vulnerabilities in (1) mod_evhost and (2) mod_simple_vhost in lighttpd before 1.4.35 allow remote attackers to read arbitrary files via a .. (dot dot) in the host name, related to request_check_hostname.


definition_id: oval:org.debian:def:214043391888947602904382876753283745342
title: CVE-2014-2326 cacti
description:
Cross-site scripting (XSS) vulnerability in cdef.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to inject arbitrary web  script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:120424676163936314911048724830853040639
title: CVE-2014-2327 cacti
description:
Cross-site request forgery (CSRF) vulnerability in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to hijack the authentication of users for unspecified commands, as demonstrated by requests that (1) modify binary files, (2) modify configurations, or (3) add arbitrary users.


definition_id: oval:org.debian:def:74255086198480780903801894767589519467
title: CVE-2014-2328 cacti
description:
lib/graph_export.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in unspecified vectors.


definition_id: oval:org.debian:def:294070305783515992770698377107703633645
title: CVE-2014-2338 strongswan
description:
IKEv2 in strongSwan 4.0.7 before 5.1.3 allows remote attackers to bypass authentication by rekeying an IKE_SA during (1) initiation or (2) re-authentication, which triggers the IKE_SA state to be set to established.


definition_id: oval:org.debian:def:4793482907224189179857459931750427935
title: CVE-2014-2383 php-dompdf
description:
dompdf.php in dompdf before 0.6.1, when DOMPDF_ENABLE_PHP is enabled, allows context-dependent attackers to bypass chroot protections and read arbitrary files via a PHP protocol and wrappers in the input_file parameter, as demonstrated by a php://filter/read=convert.base64-encode/resource in the input_file parameter.


definition_id: oval:org.debian:def:263512819219006061771382421045908131513
title: CVE-2014-2386 icinga
description:
Multiple off-by-one errors in Icinga, possibly 1.10.2 and earlier, allow remote attackers to cause a denial of service (crash) via unspecified vectors to the (1) display_nav_table, (2) print_export_link, (3) page_num_selector, or (4) page_limit_selector function in cgi/cgiutils.c or (5) status_page_num_selector function in cgi/status.c, which triggers a stack-based buffer overflow.


definition_id: oval:org.debian:def:74579185133837161251776978113749585597
title: CVE-2014-2441 virtualbox-guest-additions-iso
description:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.32, 4.2.24, and 4.3.10 allows local users to affect confidentiality, integrity, and availability via vectors related to Graphics driver (WDDM) for Windows guests.


definition_id: oval:org.debian:def:171144057400302104002609993861690482867
title: CVE-2014-2497 libgd2
description:
The gdImageCreateFromXpm function in gdxpm.c in libgd, as used in PHP 5.4.26 and earlier, allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted color table in an XPM file.


definition_id: oval:org.debian:def:100753718332374564606912207541703359665
title: CVE-2014-2523 linux
description:
net/netfilter/nf_conntrack_proto_dccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccp_new, (2) dccp_packet, or (3) dccp_error function.


definition_id: oval:org.debian:def:101886533147460463616059500983314099578
title: CVE-2014-2525 libyaml
description:
Heap-based buffer overflow in the yaml_parser_scan_uri_escapes function in LibYAML before 0.1.6 allows context-dependent attackers to execute arbitrary code via a long sequence of percent-encoded characters in a URI in a YAML file.


definition_id: oval:org.debian:def:305473842542484459729310559668637884784
title: CVE-2014-2528 k4dirstat
description:
kcleanup.cpp in KDirStat 2.7.3 does not properly quote strings when deleting a directory, which allows remote attackers to execute arbitrary commands via a ' (single quote) character in the directory name, a different vulnerability than CVE-2014-2527.


definition_id: oval:org.debian:def:325924054815633294384662756793241194590
title: CVE-2014-2532 openssh
description:
sshd in OpenSSH before 6.6 does not properly support wildcards on AcceptEnv lines in sshd_config, which allows remote attackers to bypass intended environment restrictions by using a substring located before a wildcard character.


definition_id: oval:org.debian:def:5688257210764329531148299305635680051
title: CVE-2014-2538 ruby-rack-ssl
description:
Cross-site scripting (XSS) vulnerability in lib/rack/ssl.rb in the rack-ssl gem before 1.4.0 for Ruby allows remote attackers to inject arbitrary web script or HTML via a URI, which might not be properly handled by third-party adapters such as JRuby-Rack.


definition_id: oval:org.debian:def:51165498236657806498885332831985709356
title: CVE-2014-2553 otrs2
description:
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to dynamic fields.


definition_id: oval:org.debian:def:176475688841507449008725035575823973792
title: CVE-2014-2554 otrs2
description:
OTRS 3.1.x before 3.1.21, 3.2.x before 3.2.16, and 3.3.x before 3.3.6 allows remote attackers to conduct clickjacking attacks via an IFRAME element.


definition_id: oval:org.debian:def:297643121201773116402717605020164466788
title: CVE-2014-2568 linux
description:
Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.


definition_id: oval:org.debian:def:35777296832790737123667904555909529006
title: CVE-2014-2573 nova
description:
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.


definition_id: oval:org.debian:def:212826741629220995143507875562131165045
title: CVE-2014-2576 claws-mail
description:
plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.


definition_id: oval:org.debian:def:328947324303597636069246552347686992488
title: CVE-2014-2580 linux
description:
The netback driver in Xen, when using certain Linux versions that do not allow sleeping in softirq context, allows local guest administrators to cause a denial of service ("scheduling while atomic" error and host crash) via a malformed packet, which causes a mutex to be taken when trying to disable the interface.


definition_id: oval:org.debian:def:94229820408338391410306980166057924298
title: CVE-2014-2581 smb4k
description:
Smb4K before 1.1.1 allows remote attackers to obtain credentials via vectors related to the cuid option in the "Additional options" line edit.


definition_id: oval:org.debian:def:175720451160499250705638240042237748103
title: CVE-2014-2583 pam
description:
Multiple directory traversal vulnerabilities in pam_timestamp.c in the pam_timestamp module for Linux-PAM (aka pam) 1.1.8 allow local users to create arbitrary files or possibly bypass authentication via a .. (dot dot) in the (1) PAM_RUSER value to the get_ruser function or (2) PAM_TTY value to the check_tty function, which is used by the format_timestamp_name function.


definition_id: oval:org.debian:def:195943072068027381518618460549666277391
title: CVE-2014-2599 xen
description:
The HVMOP_set_mem_access HVM control operations in Xen 4.1.x for 32-bit and 4.1.x through 4.4.x for 64-bit allow local guest administrators to cause a denial of service (CPU consumption) by leveraging access to certain service domains for HVM guests and a large input.


definition_id: oval:org.debian:def:298573312760806565982764118429626629904
title: CVE-2014-2653 openssh
description:
The verify_host_key function in sshconnect.c in the client in OpenSSH 6.6 and earlier allows remote servers to trigger the skipping of SSHFP DNS RR checking by presenting an unacceptable HostCertificate.


definition_id: oval:org.debian:def:76129991160172641280822676655218118452
title: CVE-2014-2655 postfixadmin
description:
SQL injection vulnerability in the gen_show_status function in functions.inc.php in Postfix Admin (aka postfixadmin) before 2.3.7 allows remote authenticated users to execute arbitrary SQL commands via a new alias.


definition_id: oval:org.debian:def:330975658072913288889007447649801015317
title: CVE-2014-2665 mediawiki
description:
includes/specials/SpecialChangePassword.php in MediaWiki before 1.19.14, 1.20.x and 1.21.x before 1.21.8, and 1.22.x before 1.22.5 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account, as demonstrated by tracking the victim's activity, related to a "login CSRF" issue.


definition_id: oval:org.debian:def:94211630931824622866753523973677291337
title: CVE-2014-2672 linux
description:
Race condition in the ath_tx_aggr_sleep function in drivers/net/wireless/ath/ath9k/xmit.c in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via a large amount of network traffic that triggers certain list deletions.


definition_id: oval:org.debian:def:31360244537279454578869156388041251644
title: CVE-2014-2673 linux
description:
The arch_dup_task_struct function in the Transactional Memory (TM) implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platform does not properly interact with the clone and fork system calls, which allows local users to cause a denial of service (Program Check and system crash) via certain instructions that are executed with the processor in the Transactional state.


definition_id: oval:org.debian:def:301709811764166789347378317761672707157
title: CVE-2014-2678 linux
description:
The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.


definition_id: oval:org.debian:def:57186733873059547307393022203776986305
title: CVE-2014-2706 linux
description:
Race condition in the mac80211 subsystem in the Linux kernel before 3.13.7 allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN_STA_PS_STA state (aka power-save mode), related to sta_info.c and tx.c.


definition_id: oval:org.debian:def:162317080997149556256705176903695321933
title: CVE-2014-2707 cups-filters
description:
cups-browsed in cups-filters 1.0.41 before 1.0.51 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the (1) model or (2) PDL, related to "System V interface scripts generated for queues."


definition_id: oval:org.debian:def:255473674534053049307563509419615940080
title: CVE-2014-2708 cacti
description:
Multiple SQL injection vulnerabilities in graph_xport.php in Cacti 0.8.7g, 0.8.8b, and earlier allow remote attackers to execute arbitrary SQL commands via the (1) graph_start, (2) graph_end, (3) graph_height, (4) graph_width, (5) graph_nolegend, (6) print_source, (7) local_graph_id, or (8) rra_id parameter.


definition_id: oval:org.debian:def:154959685455725526074193940143921015262
title: CVE-2014-2709 cacti
description:
lib/rrd.php in Cacti 0.8.7g, 0.8.8b, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified parameters.


definition_id: oval:org.debian:def:242624099639159469623807838546312195227
title: CVE-2014-2744 lua-expat
description:
plugins/mod_compression.lua in (1) Prosody before 0.9.4 and (2) Lightwitch Metronome through 3.4 negotiates stream compression while a session is unauthenticated, which allows remote attackers to cause a denial of service (resource consumption) via compressed XML elements in an XMPP stream, aka an "xmppbomb" attack.


definition_id: oval:org.debian:def:315251509978574383528264224622541926429
title: CVE-2014-2745 prosody
description:
Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack, related to core/portmanager.lua and util/xmppstream.lua.


definition_id: oval:org.debian:def:56704988503189755886898361664088907969
title: CVE-2014-2828 keystone
description:
The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."


definition_id: oval:org.debian:def:26766594341098596167055043835754147138
title: CVE-2014-2851 linux
description:
Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.


definition_id: oval:org.debian:def:301623869467942780125477161073547740247
title: CVE-2014-2852 openafs
description:
OpenAFS before 1.6.7 delays the listen thread when an RXS_CheckResponse fails, which allows remote attackers to cause a denial of service (performance degradation) via an invalid packet.


definition_id: oval:org.debian:def:102076905352919629612429752307428287092
title: CVE-2014-2855 rsync
description:
The check_secret function in authenticate.c in rsync 3.1.0 and earlier allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a user name which does not exist in the secrets file.


definition_id: oval:org.debian:def:293166136255153813159081704253277448307
title: CVE-2014-2856 cups
description:
Cross-site scripting (XSS) vulnerability in scheduler/client.c in Common Unix Printing System (CUPS) before 1.7.2 allows remote attackers to inject arbitrary web script or HTML via the URL path, related to the is_path_absolute function.


definition_id: oval:org.debian:def:329587700515329663153519168751781385783
title: CVE-2014-2889 linux
description:
Off-by-one error in the bpf_jit_compile function in arch/x86/net/bpf_jit_comp.c in the Linux kernel before 3.1.8, when BPF JIT is enabled, allows local users to cause a denial of service (system crash) or possibly gain privileges via a long jump after a conditional jump.


definition_id: oval:org.debian:def:66554115952757166915607564869654637817
title: CVE-2014-2891 strongswan
description:
strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.


definition_id: oval:org.debian:def:1389400642005311378848292084038220899
title: CVE-2014-2892 libmms
description:
Heap-based buffer overflow in the get_answer function in mmsh.c in libmms before 0.6.4 allows remote attackers to execute arbitrary code via a long line in an MMS over HTTP (MMSH) server response.


definition_id: oval:org.debian:def:282727393159590794952109566060067824650
title: CVE-2014-2905 fish
description:
fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly check the credentials, which allows local users to gain privileges via the universal variable socket, related to /tmp/fishd.socket.user permissions.


definition_id: oval:org.debian:def:298987770156416966430641717828858567032
title: CVE-2014-2906 fish
description:
The psub function in fish (aka fish-shell) 1.16.0 before 2.1.1 does not properly create temporary files, which allows local users to execute arbitrary commands via a temporary file with a predictable name.


definition_id: oval:org.debian:def:119550260316613342069786829757840492331
title: CVE-2014-2907 wireshark
description:
The srtp_add_address function in epan/dissectors/packet-rtp.c in the RTP dissector in Wireshark 1.10.x before 1.10.7 does not properly update SRTP conversation data, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:53268457025414440028596937275203324991
title: CVE-2014-2913 nagios-nrpe
description:
** DISPUTED ** Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe.  NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments.


definition_id: oval:org.debian:def:150723060879565358900811596264230485776
title: CVE-2014-2914 fish
description:
fish (aka fish-shell) 2.0.0 before 2.1.1 does not restrict access to the configuration service (aka fish_config), which allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by set_prompt.


definition_id: oval:org.debian:def:222224122380319699679533673522137229695
title: CVE-2014-2957 exim4
description:
The dmarc_process function in dmarc.c in Exim before 4.82.1, when EXPERIMENTAL_DMARC is enabled, allows remote attackers to execute arbitrary code via the From header in an email, which is passed to the expand_string function.


definition_id: oval:org.debian:def:75219842641590256180752549593301852480
title: CVE-2014-2972 exim4
description:
expand.c in Exim before 4.83 expands mathematical comparisons twice, which allows local users to gain privileges and execute arbitrary commands via a crafted lookup value.


definition_id: oval:org.debian:def:111635470009349226345172725687141088376
title: CVE-2014-2980 gnustep-base
description:
Tools/gdomap.c in gdomap in GNUstep Base 1.24.6 and earlier, when run in daemon mode, does not properly handle the file descriptor for the logger, which allows remote attackers to cause a denial of service (abort) via an invalid request.


definition_id: oval:org.debian:def:141286733620723740715017439127350195884
title: CVE-2014-3000 kfreebsd-10
description:
The TCP reassembly function in the inet module in FreeBSD 8.3 before p16, 8.4 before p9, 9.1 before p12, 9.2 before p5, and 10.0 before p2 allows remote attackers to cause a denial of service (undefined memory access and system crash) or possibly read system memory via multiple crafted packets, related to moving a reassemble queue entry to the segment list when the queue is full.


definition_id: oval:org.debian:def:180273676517828541216763767499733150473
title: CVE-2014-3005 zabbix
description:
XML external entity (XXE) vulnerability in Zabbix 1.8.x before 1.8.21rc1, 2.0.x before 2.0.13rc1, 2.2.x before 2.2.5rc1, and 2.3.x before 2.3.2 allows remote attackers to read arbitrary files or potentially execute arbitrary code via a crafted DTD in an XML request.


definition_id: oval:org.debian:def:136529622119607905867446967992612968315
title: CVE-2014-3007 pillow
description:
Python Image Library (PIL) 1.1.7 and earlier and Pillow 2.3 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py.


definition_id: oval:org.debian:def:153680331790295525721530346097738339535
title: CVE-2014-3121 rxvt-unicode
description:
rxvt-unicode before 9.20 does not properly handle OSC escape sequences, which allows user-assisted remote attackers to manipulate arbitrary X window properties and execute arbitrary commands.


definition_id: oval:org.debian:def:315787574639909786311927750491236311596
title: CVE-2014-3122 linux
description:
The try_to_unmap_cluster function in mm/rmap.c in the Linux kernel before 3.14.3 does not properly consider which pages must be locked, which allows local users to cause a denial of service (system crash) by triggering a memory-usage pattern that requires removal of page-table mappings.


definition_id: oval:org.debian:def:233800577358503761855145811560707870637
title: CVE-2014-3124 xen
description:
The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.


definition_id: oval:org.debian:def:79726136617143662903842583940632064155
title: CVE-2014-3127 dpkg
description:
dpkg 1.15.9 on Debian squeeze introduces support for the "C-style encoded filenames" feature without recognizing that the squeeze patch program lacks this feature, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package.  NOTE: this can be considered a release engineering problem in the effort to fix CVE-2014-0471.


definition_id: oval:org.debian:def:214387986827026666754186877467572174103
title: CVE-2014-3137 python-bottle
description:
Bottle 0.10.x before 0.10.12, 0.11.x before 0.11.7, and 0.12.x before 0.12.6 does not properly limit content types, which allows remote attackers to bypass intended access restrictions via an accepted Content-Type followed by a ; (semi-colon) and a Content-Type that would not be accepted, as demonstrated in YouCompleteMe to execute arbitrary code.


definition_id: oval:org.debian:def:172025505308802456197899960247971198668
title: CVE-2014-3144 linux
description:
The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.


definition_id: oval:org.debian:def:329681848830296444514025117565507138541
title: CVE-2014-3145 linux
description:
The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions.  NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.


definition_id: oval:org.debian:def:133573168212771933611144100515383981414
title: CVE-2014-3146 lxml
description:
Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.


definition_id: oval:org.debian:def:95727168104490750621358359542284416377
title: CVE-2014-3153 linux
description:
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.


definition_id: oval:org.debian:def:68000534091809268709407244308278194448
title: CVE-2014-3158 ppp
description:
Integer overflow in the getword function in options.c in pppd in Paul's PPP Package (ppp) before 2.4.7 allows attackers to "access privileged options" via a long word in an options file, which triggers a heap-based buffer overflow that "[corrupts] security-relevant variables."


definition_id: oval:org.debian:def:157095188470444953662333225231297950521
title: CVE-2014-3180 linux
description:
** DISPUTED ** In kernel/compat.c in the Linux kernel before 3.17, as used in Google Chrome OS and other products, there is a possible out-of-bounds read. restart_syscall uses uninitialized data when restarting compat_sys_nanosleep. NOTE: this is disputed because the code path is unreachable.


definition_id: oval:org.debian:def:220800543785351192020977633997017330514
title: CVE-2014-3181 linux
description:
Multiple stack-based buffer overflows in the magicmouse_raw_event function in drivers/hid/hid-magicmouse.c in the Magic Mouse HID driver in the Linux kernel through 3.16.3 allow physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with an event.


definition_id: oval:org.debian:def:35872485697543862430456492098561740409
title: CVE-2014-3182 linux
description:
Array index error in the logi_dj_raw_event function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to execute arbitrary code or cause a denial of service (invalid kfree) via a crafted device that provides a malformed REPORT_TYPE_NOTIF_DEVICE_UNPAIRED value.


definition_id: oval:org.debian:def:127538051596611892701871225977687960164
title: CVE-2014-3183 linux
description:
Heap-based buffer overflow in the logi_dj_ll_raw_request function in drivers/hid/hid-logitech-dj.c in the Linux kernel before 3.16.2 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that specifies a large report size for an LED report.


definition_id: oval:org.debian:def:116356433343814803176271151052568881318
title: CVE-2014-3184 linux
description:
The report_fixup functions in the HID subsystem in the Linux kernel before 3.16.2 might allow physically proximate attackers to cause a denial of service (out-of-bounds write) via a crafted device that provides a small report descriptor, related to (1) drivers/hid/hid-cherry.c, (2) drivers/hid/hid-kye.c, (3) drivers/hid/hid-lg.c, (4) drivers/hid/hid-monterey.c, (5) drivers/hid/hid-petalynx.c, and (6) drivers/hid/hid-sunplus.c.


definition_id: oval:org.debian:def:128013110235911659489991670356973446869
title: CVE-2014-3185 linux
description:
Multiple buffer overflows in the command_port_read_callback function in drivers/usb/serial/whiteheat.c in the Whiteheat USB Serial Driver in the Linux kernel before 3.16.2 allow physically proximate attackers to execute arbitrary code or cause a denial of service (memory corruption and system crash) via a crafted device that provides a large amount of (1) EHCI or (2) XHCI data associated with a bulk response.


definition_id: oval:org.debian:def:169666172828690307647442365741538129047
title: CVE-2014-3186 linux
description:
Buffer overflow in the picolcd_raw_event function in devices/hid/hid-picolcd_core.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.


definition_id: oval:org.debian:def:5813776659607814969460992548677933268
title: CVE-2014-3207 sks
description:
Cross-site scripting (XSS) vulnerability in wserver.ml in SKS Keyserver before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to pks/lookup/undefined1.


definition_id: oval:org.debian:def:23253386032495857113521335810981487013
title: CVE-2014-3209 ldns
description:
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.


definition_id: oval:org.debian:def:117962878823646540843430825806781569445
title: CVE-2014-3219 fish
description:
fish before 2.1.1 allows local users to write to arbitrary files via a symlink attack on (1) /tmp/fishd.log.%s, (2) /tmp/.pac-cache.$USER, (3) /tmp/.yum-cache.$USER, or (4) /tmp/.rpm-cache.$USER.


definition_id: oval:org.debian:def:84275485575759627065552472136646443771
title: CVE-2014-3227 dpkg
description:
dpkg 1.15.9, 1.16.x before 1.16.14, and 1.17.x before 1.17.9 expect the patch program to be compliant with a need for the "C-style encoded filenames" feature, but is supported in environments with noncompliant patch programs, which triggers an interaction error that allows remote attackers to conduct directory traversal attacks and modify files outside of the intended directories via a crafted source package. NOTE: this vulnerability exists because of reliance on unrealistic constraints on the behavior of an external program.


definition_id: oval:org.debian:def:200542110484970517032719278367183439591
title: CVE-2014-3230 liblwp-protocol-https-perl
description:
The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.


definition_id: oval:org.debian:def:141706138252133597782181720428969763651
title: CVE-2014-3242 python-soappy
description:
SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:223099798781563369403914037974562640489
title: CVE-2014-3243 python-soappy
description:
SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references.


definition_id: oval:org.debian:def:84110281797674448040988514355302289361
title: CVE-2014-3248 facter
description:
Untrusted search path vulnerability in Puppet Enterprise 2.8 before 2.8.7, Puppet before 2.7.26 and 3.x before 3.6.2, Facter 1.6.x and 2.x before 2.0.2, Hiera before 1.3.4, and Mcollective before 2.5.2, when running with Ruby 1.9.1 or earlier, allows local users to gain privileges via a Trojan horse file in the current working directory, as demonstrated using (1) rubygems/defaults/operating_system.rb, (2) Win32API.rb, (3) Win32API.so, (4) safe_yaml.rb, (5) safe_yaml/deep.rb, or (6) safe_yaml/deep.so; or (7) operatingsystem.rb, (8) operatingsystem.so, (9) osfamily.rb, or (10) osfamily.so in puppet/confine.


definition_id: oval:org.debian:def:322540956611725419067659186569462229119
title: CVE-2014-3250 puppet
description:
The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain sensitive information via a revoked certificate when a Puppet master runs with Apache 2.4.


definition_id: oval:org.debian:def:31460832597579933349104457626223048332
title: CVE-2014-3251 mcollective
description:
The MCollective aes_security plugin, as used in Puppet Enterprise before 3.3.0 and Mcollective before 2.5.3, does not properly validate new server certificates based on the CA certificate, which allows local users to establish unauthorized Mcollective connections via unspecified vectors related to a race condition.


definition_id: oval:org.debian:def:207353663409573307955006195116001764898
title: CVE-2014-3429 ipython
description:
IPython Notebook 0.12 through 1.x before 1.2 does not validate the origin of websocket requests, which allows remote attackers to execute arbitrary code by leveraging knowledge of the kernel id and a crafted page.


definition_id: oval:org.debian:def:338469118367509310828261671432175227563
title: CVE-2014-3430 dovecot
description:
Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection.


definition_id: oval:org.debian:def:271692980793956917344309737673537377625
title: CVE-2014-3462 encfs
description:
The ".encfs6.xml" configuration file in encfs before 1.7.5 allows remote attackers to access sensitive data by setting "blockMACBytes" to 0 and adding 8 to "blockMACRandBytes".


definition_id: oval:org.debian:def:73400441471086822194334906782215031248
title: CVE-2014-3465 gnutls28
description:
The gnutls_x509_dn_oid_name function in lib/x509/common.c in GnuTLS 3.0 before 3.1.20 and 3.2.x before 3.2.10 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted X.509 certificate, related to a missing LDAP description for an OID when printing the DN.


definition_id: oval:org.debian:def:10417160196082591413407512534626601352
title: CVE-2014-3466 gnutls28
description:
Buffer overflow in the read_server_hello function in lib/gnutls_handshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a long session id in a ServerHello message.


definition_id: oval:org.debian:def:101610914693749641668548633591829968053
title: CVE-2014-3467 libtasn1-6
description:
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.


definition_id: oval:org.debian:def:233902033818653982809869173903944167528
title: CVE-2014-3468 libtasn1-6
description:
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.


definition_id: oval:org.debian:def:312771867668362514176335704848863881330
title: CVE-2014-3469 libtasn1-6
description:
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.


definition_id: oval:org.debian:def:151468828632946735529771051805047871091
title: CVE-2014-3470 openssl
description:
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.


definition_id: oval:org.debian:def:222569612847626104246942935994591101960
title: CVE-2014-3471 qemu
description:
Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU instance crash) via hotplug and hotunplug operations of Virtio block devices.


definition_id: oval:org.debian:def:336286476108591537658067757176870487000
title: CVE-2014-3476 keystone
description:
OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.


definition_id: oval:org.debian:def:210468931826734096994382587501362272335
title: CVE-2014-3477 dbus
description:
The dbus-daemon in D-Bus 1.2.x through 1.4.x, 1.6.x before 1.6.20, and 1.8.x before 1.8.4, sends an AccessDenied error to the service instead of a client when the client is prohibited from accessing the service, which allows local users to cause a denial of service (initialization failure and exit) or possibly conduct a side-channel attack via a D-Bus message to an inactive service.


definition_id: oval:org.debian:def:207035334524171529622617391922343009006
title: CVE-2014-3478 file
description:
Buffer overflow in the mconvert function in softmagic.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, allows remote attackers to cause a denial of service (application crash) via a crafted Pascal string in a FILE_PSTRING conversion.


definition_id: oval:org.debian:def:291856507305609314418525403860359452494
title: CVE-2014-3479 file
description:
The cdf_check_stream_offset function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, relies on incorrect sector-size data, which allows remote attackers to cause a denial of service (application crash) via a crafted stream offset in a CDF file.


definition_id: oval:org.debian:def:72209529541291869584065285527159375044
title: CVE-2014-3480 file
description:
The cdf_count_chain function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate sector-count data, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.


definition_id: oval:org.debian:def:266371745900617160755236453396465858090
title: CVE-2014-3482 rails
description:
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.


definition_id: oval:org.debian:def:297607969252162782867627804308123357169
title: CVE-2014-3483 rails
description:
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.


definition_id: oval:org.debian:def:237390313905970406565597016014506176845
title: CVE-2014-3484 musl
description:
Multiple stack-based buffer overflows in the __dn_expand function in network/dn_expand.c in musl libc 1.1x before 1.1.2 and 0.9.13 through 1.0.3 allow remote attackers to (1) have unspecified impact via an invalid name length in a DNS response or (2) cause a denial of service (crash) via an invalid name length in a DNS response, related to an infinite loop with no output.


definition_id: oval:org.debian:def:179638700544983978398538788766864124545
title: CVE-2014-3487 file
description:
The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.


definition_id: oval:org.debian:def:177724066045435000082335504929958170498
title: CVE-2014-3493 samba
description:
It was discovered that smbd, the Samba file server daemon, did not properly handle certain files that were stored on the disk and used a valid Unicode character in the file name. An attacker able to send an authenticated non-Unicode request that attempted to read such a file could cause smbd to crash.


definition_id: oval:org.debian:def:47432412915744786054862106130017313214
title: CVE-2014-3494 kde4libs
description:
kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, which allows man-in-the-middle attackers to obtain sensitive information via an invalid certificate.


definition_id: oval:org.debian:def:164951741333085413969020178938641615820
title: CVE-2014-3497 swift
description:
It was found that Swift did not escape all HTTP header values, allowing data to be injected into the responses sent from the Swift server. This could lead to cross-site scripting attacks (and possibly other impacts) if a user were tricked into clicking on a malicious URL.


definition_id: oval:org.debian:def:310502780288785853359440592422221145950
title: CVE-2014-3498 ansible
description:
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.


definition_id: oval:org.debian:def:151801572620590728167753599004259389129
title: CVE-2014-3504 serf
description:
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:53732709246461246292256206399580107142
title: CVE-2014-3505 openssl
description:
Double free vulnerability in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (application crash) via crafted DTLS packets that trigger an error condition.


definition_id: oval:org.debian:def:272482732459484193390782666931961871630
title: CVE-2014-3506 openssl
description:
d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via crafted DTLS handshake messages that trigger memory allocations corresponding to large length values.


definition_id: oval:org.debian:def:40598653455695064605582675513973735156
title: CVE-2014-3507 openssl
description:
Memory leak in d1_both.c in the DTLS implementation in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote attackers to cause a denial of service (memory consumption) via zero-length DTLS fragments that trigger improper handling of the return value of a certain insert function.


definition_id: oval:org.debian:def:207862355963264450990497113618338185893
title: CVE-2014-3508 openssl
description:
The OBJ_obj2txt function in crypto/objects/obj_dat.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i, when pretty printing is used, does not ensure the presence of '\0' characters, which allows context-dependent attackers to obtain sensitive information from process stack memory by reading output from X509_name_oneline, X509_name_print_ex, and unspecified other functions.


definition_id: oval:org.debian:def:3302249556599655953194230624613709769
title: CVE-2014-3509 openssl
description:
Race condition in the ssl_parse_serverhello_tlsext function in t1_lib.c in OpenSSL 1.0.0 before 1.0.0n and 1.0.1 before 1.0.1i, when multithreading and session resumption are used, allows remote SSL servers to cause a denial of service (memory overwrite and client application crash) or possibly have unspecified other impact by sending Elliptic Curve (EC) Supported Point Formats Extension data.


definition_id: oval:org.debian:def:81112879844207882017414916219723545085
title: CVE-2014-3510 openssl
description:
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL 0.9.8 before 0.9.8zb, 1.0.0 before 1.0.0n, and 1.0.1 before 1.0.1i allows remote DTLS servers to cause a denial of service (NULL pointer dereference and client application crash) via a crafted handshake message in conjunction with a (1) anonymous DH or (2) anonymous ECDH ciphersuite.


definition_id: oval:org.debian:def:82057173454340060864715115288594124317
title: CVE-2014-3511 openssl
description:
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1 before 1.0.1i allows man-in-the-middle attackers to force the use of TLS 1.0 by triggering ClientHello message fragmentation in communication between a client and server that both support later TLS versions, related to a "protocol downgrade" issue.


definition_id: oval:org.debian:def:225218618512932751353064915600513549870
title: CVE-2014-3512 openssl
description:
Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via an invalid SRP (1) g, (2) A, or (3) B parameter.


definition_id: oval:org.debian:def:311667032864007665807972666852150140746
title: CVE-2014-3513 openssl
description:
Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenSSL 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted handshake message.


definition_id: oval:org.debian:def:91394786652370424165048397448851461469
title: CVE-2014-3514 rails
description:
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.


definition_id: oval:org.debian:def:276970174971125299546267721818761878193
title: CVE-2014-3517 nova
description:
A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron.


definition_id: oval:org.debian:def:232063027965500827622993286854091450738
title: CVE-2014-3520 keystone
description:
A flaw was found in the way keystone handled trusts. A trustee could use an out-of-scope project ID to gain unauthorized access to a project if the trustor had the required roles for that requested project.


definition_id: oval:org.debian:def:321316862587176711221363518286763572021
title: CVE-2014-3522 subversion
description:
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.


definition_id: oval:org.debian:def:97545167082418255745703841318480531255
title: CVE-2014-3525 trafficserver
description:
Unspecified vulnerability in Apache Traffic Server 3.x through 3.2.5, 4.x before 4.2.1.1, and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.


definition_id: oval:org.debian:def:29825494013479305811302396055479416853
title: CVE-2014-3528 subversion
description:
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.


definition_id: oval:org.debian:def:169178017702883585940487602206561001889
title: CVE-2014-3529 libapache-poi-java
description:
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:337515005530477698753543041419168298180
title: CVE-2014-3532 dbus
description:
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6, when running on Linux 2.6.37-rc4 or later, allows local users to cause a denial of service (system-bus disconnect of other services or applications) by sending a message containing a file descriptor, then exceeding the maximum recursion depth before the initial message is forwarded.


definition_id: oval:org.debian:def:14318857655675875785411879514051047538
title: CVE-2014-3533 dbus
description:
dbus 1.3.0 before 1.6.22 and 1.8.x before 1.8.6 allows local users to cause a denial of service (disconnect) via a certain sequence of crafted messages that cause the dbus-daemon to forward a message containing an invalid file descriptor.


definition_id: oval:org.debian:def:308079795689463758746752357504840294703
title: CVE-2014-3534 linux
description:
It was found that Linux kernel's ptrace subsystem did not properly sanitize the address-space-control bits when the program-status word (PSW) was being set. On IBM S/390 systems, a local, unprivileged user could use this flaw to set address-space-control bits to the kernel space, and thus gain read and write access to kernel memory.


definition_id: oval:org.debian:def:165423258061222518673925914258592777829
title: CVE-2014-3537 cups
description:
It was discovered that CUPS allowed certain users to create symbolic links in certain directories under /var/cache/cups/. A local user with the 'lp' group privileges could use this flaw to read the contents of arbitrary files on the system or, potentially, escalate their privileges on the system.


definition_id: oval:org.debian:def:118255158398489885737932705184102160710
title: CVE-2014-3538 file
description:
file before 5.19 does not properly restrict the amount of data read during a regex search, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted file that triggers backtracking during processing of an awk rule.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7345.


definition_id: oval:org.debian:def:265510922737662321850745410246630122860
title: CVE-2014-3539 rope
description:
base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.


definition_id: oval:org.debian:def:40758856797893172696431802958052253720
title: CVE-2014-3554 libndp
description:
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.


definition_id: oval:org.debian:def:158311026775698977408890503986826550465
title: CVE-2014-3555 neutron
description:
A denial of service flaw was found in neutron's handling of allowed address pairs. As there was no enforced quota on the amount of allowed address pairs, a sufficiently authorized user could possibly create a large number of firewall rules, impacting performance or potentially rendering a compute node unusable.


definition_id: oval:org.debian:def:164461909494149190668209144537837821733
title: CVE-2014-3556 nginx
description:
The STARTTLS implementation in mail/ngx_mail_smtp_handler.c in the SMTP proxy in nginx 1.5.x and 1.6.x before 1.6.1 and 1.7.x before 1.7.4 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


definition_id: oval:org.debian:def:116574241227655032525834942971411255875
title: CVE-2014-3558 libhibernate-validator-java
description:
ReflectionHelper (org.hibernate.validator.util.ReflectionHelper) in Hibernate Validator 4.1.0 before 4.2.1, 4.3.x before 4.3.2, and 5.x before 5.1.2 allows attackers to bypass Java Security Manager (JSM) restrictions and execute restricted reflection calls via a crafted application.


definition_id: oval:org.debian:def:258272972296517984311437479751335504609
title: CVE-2014-3560 samba
description:
NetBIOS name services daemon (nmbd) in Samba 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory, involving a sizeof operation on an incorrect variable in the unstrcpy macro in string_wrappers.h.


definition_id: oval:org.debian:def:325718379333299953835462034674209728421
title: CVE-2014-3562 389-ds-base
description:
It was found that when replication was enabled for each attribute in Red Hat Directory Server / 389 Directory Server, which is the default configuration, the server returned replicated metadata when the directory was searched while debugging was enabled. A remote attacker could use this flaw to disclose potentially sensitive information.


definition_id: oval:org.debian:def:15076805584014766319957158828060331413
title: CVE-2014-3563 salt
description:
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.


definition_id: oval:org.debian:def:130963049225353620368003511257497224697
title: CVE-2014-3564 gpgme1.0
description:
Multiple heap-based buffer overflows in the status_handler function in (1) engine-gpgsm.c and (2) engine-uiserver.c in GPGME before 1.5.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to "different line lengths in a specific order."


definition_id: oval:org.debian:def:44067081413162785394387583853828882355
title: CVE-2014-3565 net-snmp
description:
A denial of service flaw was found in the way snmptrapd handled certain SNMP traps when started with the "-OQ" option. If an attacker sent an SNMP trap containing a variable with a NULL type where an integer variable type was expected, it would cause snmptrapd to crash.


definition_id: oval:org.debian:def:9979216608604249092389787389020182315
title: CVE-2014-3566 erlang
description:
A flaw was found in the way SSL 3.0 handled padding bytes when decrypting messages encrypted using block ciphers in cipher block chaining (CBC) mode. This flaw allows a man-in-the-middle (MITM) attacker to decrypt a selected byte of a cipher text in as few as 256 tries if they are able to force a victim application to repeatedly send the same data over newly created SSL 3.0 connections.


definition_id: oval:org.debian:def:193624189128020364334163820583927631955
title: CVE-2014-3567 openssl
description:
Memory leak in the tls_decrypt_ticket function in t1_lib.c in OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j allows remote attackers to cause a denial of service (memory consumption) via a crafted session ticket that triggers an integrity-check failure.


definition_id: oval:org.debian:def:311617009654471281604606960548191833717
title: CVE-2014-3568 openssl
description:
OpenSSL before 0.9.8zc, 1.0.0 before 1.0.0o, and 1.0.1 before 1.0.1j does not properly enforce the no-ssl3 build option, which allows remote attackers to bypass intended access restrictions via an SSL 3.0 handshake, related to s23_clnt.c and s23_srvr.c.


definition_id: oval:org.debian:def:224148289336027790888860068153031310787
title: CVE-2014-3569 openssl
description:
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 0.9.8zc, 1.0.0o, and 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshake to a no-ssl3 application with certain error handling.  NOTE: this issue became relevant after the CVE-2014-3568 fix.


definition_id: oval:org.debian:def:248571396209852650498338344797965508878
title: CVE-2014-3570 openssl
description:
The BN_sqr implementation in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k does not properly calculate the square of a BIGNUM value, which might make it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors, related to crypto/bn/asm/mips.pl, crypto/bn/asm/x86_64-gcc.c, and crypto/bn/bn_asm.c.


definition_id: oval:org.debian:def:32714796734355655583653221758357276378
title: CVE-2014-3571 openssl
description:
OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted DTLS message that is processed with a different read operation for the handshake header than for the handshake body, related to the dtls1_get_record function in d1_pkt.c and the ssl3_read_n function in s3_pkt.c.


definition_id: oval:org.debian:def:287389642676426792983244800688936136199
title: CVE-2014-3572 openssl
description:
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k allows remote SSL servers to conduct ECDHE-to-ECDH downgrade attacks and trigger a loss of forward secrecy by omitting the ServerKeyExchange message.


definition_id: oval:org.debian:def:321031121047799151270336310316634995141
title: CVE-2014-3574 libapache-poi-java
description:
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:120766020326731421111678559370199260429
title: CVE-2014-3576 activemq
description:
The processControlCommand function in broker/TransportConnection.java in Apache ActiveMQ before 5.11.0 allows remote attackers to cause a denial of service (shutdown) via a shutdown command.


definition_id: oval:org.debian:def:109107562175756797040457068382880415922
title: CVE-2014-3577 commons-httpclient
description:
org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.


definition_id: oval:org.debian:def:115787229253009513155281032283872755765
title: CVE-2014-3578 libspring-java
description:
Directory traversal vulnerability in Pivotal Spring Framework 3.x before 3.2.9 and 4.0 before 4.0.5 allows remote attackers to read arbitrary files via a crafted URL.


definition_id: oval:org.debian:def:77512092147773912338009684678909871989
title: CVE-2014-3580 subversion
description:
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.


definition_id: oval:org.debian:def:64962794119378370269139101453869166427
title: CVE-2014-3581 apache2
description:
The cache_merge_headers_out function in modules/cache/cache_util.c in the mod_cache module in the Apache HTTP Server before 2.4.11 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty HTTP Content-Type header.


definition_id: oval:org.debian:def:202357296731916352944386370898812875369
title: CVE-2014-3583 apache2
description:
The handle_headers function in mod_proxy_fcgi.c in the mod_proxy_fcgi module in the Apache HTTP Server 2.4.10 allows remote FastCGI servers to cause a denial of service (buffer over-read and daemon crash) via long response headers.


definition_id: oval:org.debian:def:301263106196480356252255459806742361143
title: CVE-2014-3587 file
description:
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.


definition_id: oval:org.debian:def:21130244841222683855732432178193944460
title: CVE-2014-3589 pillow
description:
PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.


definition_id: oval:org.debian:def:338413367558163886881406997503554218749
title: CVE-2014-3591 libgcrypt20
description:
Libgcrypt before 1.6.3 and GnuPG before 1.4.19 does not implement ciphertext blinding for Elgamal decryption, which allows physically proximate attackers to obtain the server's private key by determining factors using crafted ciphertext and the fluctuations in the electromagnetic field during multiplication.


definition_id: oval:org.debian:def:176406283225313209542333610686991518169
title: CVE-2014-3594 horizon
description:
A persistent cross-site scripting (XSS) flaw was found in the horizon host aggregate interface. A user with sufficient privileges to add a host aggregate could potentially use this flaw to capture the credentials of another user.


definition_id: oval:org.debian:def:36830065277056811151006047385993086120
title: CVE-2014-3596 axis
description:
It was discovered that Axis incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.


definition_id: oval:org.debian:def:114144859072372268734321663305421708098
title: CVE-2014-3598 pillow
description:
The Jpeg2KImagePlugin plugin in Pillow before 2.5.3 allows remote attackers to cause a denial of service via a crafted image.


definition_id: oval:org.debian:def:70677673418875523600892182033635562332
title: CVE-2014-3600 activemq
description:
XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.


definition_id: oval:org.debian:def:3635177082594489425510028795552690829
title: CVE-2014-3601 linux
description:
The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.16.1 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to (1) cause a denial of service (host OS memory corruption) or possibly have unspecified other impact by triggering a large gfn value or (2) cause a denial of service (host OS memory consumption) by triggering a small gfn value that leads to permanently pinned pages.


definition_id: oval:org.debian:def:339592336497431793293768742186195750097
title: CVE-2014-3607 libvt-ldap-java
description:
DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:276471916795370222781341808301411008894
title: CVE-2014-3608 nova
description:
CVE-2014-3608 openstack-nova: incomplete fix for CVE-2014-2573, Nova VMware driver still leaks rescued images


definition_id: oval:org.debian:def:273277096700050829310375931278156533745
title: CVE-2014-3609 squid
description:
HttpHdrRange.cc in Squid 3.x before 3.3.12 and 3.4.x before 3.4.6 allows remote attackers to cause a denial of service (crash) via a request with crafted "Range headers with unidentifiable byte-range values."


definition_id: oval:org.debian:def:238287795218313553324777618365047209252
title: CVE-2014-3610 linux
description:
It was found that KVM's Write to Model Specific Register (WRMSR) instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host.


definition_id: oval:org.debian:def:149576803551424529860355637290981225267
title: CVE-2014-3611 linux
description:
A race condition flaw was found in the way the Linux kernel's KVM subsystem handled PIT (Programmable Interval Timer) emulation. A guest user who has access to the PIT I/O ports could use this flaw to crash the host.


definition_id: oval:org.debian:def:57355169316104854791483641202187829291
title: CVE-2014-3612 activemq
description:
The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.


definition_id: oval:org.debian:def:108740823605273351355934998708126759210
title: CVE-2014-3613 curl
description:
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.


definition_id: oval:org.debian:def:62608374809959934477835056372192719425
title: CVE-2014-3614 pdns-recursor
description:
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.


definition_id: oval:org.debian:def:297577719727661176208065311997180323446
title: CVE-2014-3615 qemu
description:
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.


definition_id: oval:org.debian:def:110092606808933018716093624292564619118
title: CVE-2014-3616 nginx
description:
nginx 0.5.6 through 1.7.4, when using the same shared ssl_session_cache or ssl_session_ticket_key for multiple servers, can reuse a cached SSL session for an unrelated context, which allows remote attackers with certain privileges to conduct "virtual host confusion" attacks.


definition_id: oval:org.debian:def:308295326922904080984754937837046966846
title: CVE-2014-3618 procmail
description:
A heap-based buffer overflow flaw was found in procmail's formail utility. A remote attacker could send an email with specially crafted headers that, when processed by formail, could cause procmail to crash or, possibly, execute arbitrary code as the user running formail.


definition_id: oval:org.debian:def:338130428596946743951491468120867139965
title: CVE-2014-3619 glusterfs
description:
A denial of service flaw was found in the way the __socket_proto_state_machine() function of glusterfs processed certain fragment headers. A remote attacker could send a specially crafted fragment header that, when processed, would cause the glusterfs process to enter an infinite loop.


definition_id: oval:org.debian:def:151957177058002308887697436824637377600
title: CVE-2014-3620 curl
description:
cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.


definition_id: oval:org.debian:def:281137451420100830594933307530194966034
title: CVE-2014-3621 keystone
description:
A flaw was found in the keystone catalog URL replacement. A user with permissions to register an endpoint could use this flaw to leak configuration data, including the master admin_token. Only keystone setups that allow non-cloud-admin users to create endpoints were affected by this issue.


definition_id: oval:org.debian:def:13015187632863413854839591189464861216
title: CVE-2014-3624 trafficserver
description:
Apache Traffic Server 5.1.x before 5.1.1 allows remote attackers to bypass access restrictions by leveraging failure to properly tunnel remap requests using CONNECT.


definition_id: oval:org.debian:def:200032406981910825927883021351413032280
title: CVE-2014-3625 libspring-java
description:
Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.


definition_id: oval:org.debian:def:261401711151718129639430725994209544728
title: CVE-2014-3631 linux
description:
The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation.


definition_id: oval:org.debian:def:62485018402503436549860937587165043056
title: CVE-2014-3633 libvirt
description:
An out-of-bounds read flaw was found in the way libvirt's qemuDomainGetBlockIoTune() function looked up the disk index in a non-persistent (live) disk configuration while a persistent disk configuration was being indexed. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to crash libvirtd or, potentially, leak memory from the libvirtd process.


definition_id: oval:org.debian:def:232740044631895796480060423380043599072
title: CVE-2014-3634 inetutils
description:
rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibly execute arbitrary code, or have other unspecified impact via a crafted priority (PRI) value that triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:201378567580466019469547033609952316855
title: CVE-2014-3635 dbus
description:
Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix_fds limit is set to an odd number, allows local users to cause a denial of service (dbus-daemon crash) or possibly execute arbitrary code by sending one more file descriptor than the limit, which triggers a heap-based buffer overflow or an assertion failure.


definition_id: oval:org.debian:def:234522299621585338010638234669152863100
title: CVE-2014-3636 dbus
description:
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connections and connection drop) by queuing the maximum number of file descriptors or (2) cause a denial of service (disconnect) via multiple messages that combine to have more than the allowed number of file descriptors for a single sendmsg call.


definition_id: oval:org.debian:def:134517958649808963079793653514888540055
title: CVE-2014-3637 dbus
description:
D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which allows local users to cause a denial of service via a D-bus message containing a D-Bus connection file descriptor.


definition_id: oval:org.debian:def:311535582541420256339840075819716383331
title: CVE-2014-3638 dbus
description:
The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a denial of service (CPU consumption) via a large number of method calls.


definition_id: oval:org.debian:def:83680017818355537838751332147170601574
title: CVE-2014-3639 dbus
description:
The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a denial of service (incomplete connection consumption and prevention of new connections) via a large number of incomplete connections.


definition_id: oval:org.debian:def:128939214433531589769064321702086083077
title: CVE-2014-3640 qemu
description:
A NULL pointer dereference flaw was found in the way QEMU handled UDP packets with a source port and address of 0 when QEMU's user networking was in use. A local guest user could use this flaw to crash the guest.


definition_id: oval:org.debian:def:41448404957393699386845220997663270447
title: CVE-2014-3645 linux
description:
It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invept (Invalidate Translations Derived from EPT) instructions. On hosts with an Intel processor and invept VM exit support, an unprivileged guest user could use these instructions to crash the guest.


definition_id: oval:org.debian:def:301161938232643165041053681521456652775
title: CVE-2014-3646 linux
description:
It was found that the Linux kernel's KVM subsystem did not handle the VM exits gracefully for the invvpid (Invalidate Translations Based on VPID) instructions. On hosts with an Intel processor and invppid VM exit support, an unprivileged guest user could use these instructions to crash the guest.


definition_id: oval:org.debian:def:25383883291622415591727320769979324060
title: CVE-2014-3647 linux
description:
A flaw was found in the way the Linux kernel's KVM subsystem handled non-canonical addresses when emulating instructions that change the RIP (for example, branches or calls). A guest user with access to an I/O or MMIO region could use this flaw to crash the guest.


definition_id: oval:org.debian:def:279683472597213584242537771004422138583
title: CVE-2014-3657 libvirt
description:
A denial of service flaw was found in the way libvirt's virConnectListAllDomains() function computed the number of used domains. A remote attacker able to establish a read-only connection to libvirtd could use this flaw to make any domain operations within libvirt unresponsive.


definition_id: oval:org.debian:def:311069294174399115916816135914505505281
title: CVE-2014-3660 libxml2
description:
parser.c in libxml2 before 2.9.2 does not properly prevent entity expansion even when entity substitution has been disabled, which allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted XML document containing a large number of nested entity references, a variant of the "billion laughs" attack.


definition_id: oval:org.debian:def:29512587836218954739951543270382820185
title: CVE-2014-3672 xen
description:
The qemu implementation in libvirt before 1.3.0 and Xen allows local guest OS users to cause a denial of service (host disk consumption) by writing to stdout or stderr.


definition_id: oval:org.debian:def:304242445589223907237385202952943108877
title: CVE-2014-3673 linux
description:
A flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled malformed Address Configuration Change Chunks (ASCONF). A remote attacker could use either of these flaws to crash the system.


definition_id: oval:org.debian:def:156681301039065557647199313217767283359
title: CVE-2014-3683 rsyslog
description:
Integer overflow in rsyslog before 7.6.7 and 8.x before 8.4.2 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash) via a large priority (PRI) value.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3634.


definition_id: oval:org.debian:def:335344528451939523048006246807859737554
title: CVE-2014-3686 wpa
description:
wpa_supplicant and hostapd 0.7.2 through 2.2, when running with certain configurations and using wpa_cli or hostapd_cli with action scripts, allows remote attackers to execute arbitrary commands via a crafted frame.


definition_id: oval:org.debian:def:140705254807577196598381221852943209156
title: CVE-2014-3687 linux
description:
The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (panic) via duplicate ASCONF chunks that trigger an incorrect uncork within the side-effect interpreter.


definition_id: oval:org.debian:def:26967585374126985119409042187035317633
title: CVE-2014-3688 linux
description:
The SCTP implementation in the Linux kernel before 3.17.4 allows remote attackers to cause a denial of service (memory consumption) by triggering a large number of chunks in an association's output queue, as demonstrated by ASCONF probes, related to net/sctp/inqueue.c and net/sctp/sm_statefuns.c.


definition_id: oval:org.debian:def:226661049772198828980023685425499459055
title: CVE-2014-3689 qemu
description:
The vmware-vga driver (hw/display/vmware_vga.c) in QEMU allows local guest users to write to qemu memory locations and gain privileges via unspecified parameters related to rectangle handling.


definition_id: oval:org.debian:def:278873325985830332099137482530217750437
title: CVE-2014-3690 linux
description:
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.


definition_id: oval:org.debian:def:61466380177024490847474599891375504745
title: CVE-2014-3693 libreoffice
description:
A use-after-free flaw was found in the "Remote Control" capabilities of the LibreOffice Impress application. An attacker could use this flaw to remotely execute code with the permissions of the user running LibreOffice Impress.


definition_id: oval:org.debian:def:194796770568953900776069975694582444353
title: CVE-2014-3694 pidgin
description:
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.


definition_id: oval:org.debian:def:132846616142857087140274182578569733001
title: CVE-2014-3695 pidgin
description:
markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a large length value in an emoticon response.


definition_id: oval:org.debian:def:272146743492020466934088123705990954197
title: CVE-2014-3696 pidgin
description:
nmevent.c in the Novell GroupWise protocol plugin in libpurple in Pidgin before 2.10.10 allows remote servers to cause a denial of service (application crash) via a crafted server message that triggers a large memory allocation.


definition_id: oval:org.debian:def:139247968296018783693664243040118586880
title: CVE-2014-3698 pidgin
description:
The jabber_idn_validate function in jutil.c in the Jabber protocol plugin in libpurple in Pidgin before 2.10.10 allows remote attackers to obtain sensitive information from process memory via a crafted XMPP message.


definition_id: oval:org.debian:def:221238601456499258339065668906673970606
title: CVE-2014-3707 curl
description:
The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.


definition_id: oval:org.debian:def:115219257248195864263583611350412398493
title: CVE-2014-3708 nova
description:
A denial of service flaw was found in the way OpenStack Compute (nova) looked up VM instances based on an IP address filter. An attacker with sufficient privileges on an OpenStack installation with a large amount of VMs could use this flaw to cause the main nova process to block for an extended amount of time.


definition_id: oval:org.debian:def:1913022356316049675213829597943973253
title: CVE-2014-3710 file
description:
The donote function in readelf.c in file through 5.20, as used in the Fileinfo component in PHP 5.4.34, does not ensure that sufficient note headers are present, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.


definition_id: oval:org.debian:def:95707441832067519461359365989876782090
title: CVE-2014-3711 kfreebsd-10
description:
namei in FreeBSD 9.1 through 10.1-RC2 allows remote attackers to cause a denial of service (memory exhaustion) via vectors that trigger a sandboxed process to look up a large number of nonexistent path names.


definition_id: oval:org.debian:def:208045190925742816533015249832252454019
title: CVE-2014-3730 python-django
description:
The django.util.http.is_safe_url function in Django 1.4 before 1.4.13, 1.5 before 1.5.8, 1.6 before 1.6.5, and 1.7 before 1.7b4 does not properly validate URLs, which allows remote attackers to conduct open redirect attacks via a malformed URL, as demonstrated by "http:\\\djangoproject.com."


definition_id: oval:org.debian:def:258459813657218068827911076551155861438
title: CVE-2014-3743 node-marked
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.


definition_id: oval:org.debian:def:47790657103656153347682530183694450929
title: CVE-2014-3755 mumble
description:
The QSvg module in Qt, as used in the Mumble client 1.2.x before 1.2.6, allows remote attackers to cause a denial of service (hang and resource consumption) via a local file reference in an (1) image tag or (2) XML stylesheet in an SVG file.


definition_id: oval:org.debian:def:19582753023455555805753584164390589492
title: CVE-2014-3756 mumble
description:
The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip.


definition_id: oval:org.debian:def:80873138057626076561351384566491146108
title: CVE-2014-3775 libgadu
description:
libgadu before 1.11.4 and 1.12.0 before 1.12.0-rc3, as used in Pidgin and other products, allows remote Gadu-Gadu file relay servers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted message.


definition_id: oval:org.debian:def:311680267773099346950433605184895396406
title: CVE-2014-3776 chicken
description:
Buffer overflow in the "read-u8vector!" procedure in the srfi-4 unit in CHICKEN stable 4.8.0.7 and development snapshots before 4.9.1 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.


definition_id: oval:org.debian:def:250225543905186056830655080014388466816
title: CVE-2014-3801 heat
description:
OpenStack Orchestration API (Heat) 2013.2 through 2013.2.3 and 2014.1, when creating the stack for a template using a provider template, allows remote authenticated users to obtain the provider template URL via the resource-type-list.


definition_id: oval:org.debian:def:3548943880013892334423521685256861004
title: CVE-2014-3856 fish
description:
The funced function in fish (aka fish-shell) 1.23.0 before 2.1.1 does not properly create temporary files, which allows local users to gain privileges via a temporary file with a predictable name.


definition_id: oval:org.debian:def:24017834066131511315648386223925592221
title: CVE-2014-3864 dpkg
description:
Directory traversal vulnerability in dpkg-source in dpkg-dev 1.3.0 allows remote attackers to modify files outside of the intended directories via a crafted source package that lacks a --- header line.


definition_id: oval:org.debian:def:76508335870189815427865808910277991970
title: CVE-2014-3865 dpkg
description:
Multiple directory traversal vulnerabilities in dpkg-source in dpkg-dev 1.3.0 allow remote attackers to modify files outside of the intended directories via a source package with a crafted Index: pseudo-header in conjunction with (1) missing --- and +++ header lines or (2) a +++ header line with a blank pathname.


definition_id: oval:org.debian:def:243982772925221048900571994269926266057
title: CVE-2014-3875 fex
description:
The addto parameter to fup in Frams' Fast File EXchange (F*EX, aka fex) before fex-2014053 allows remote attackers to conduct cross-site scripting (XSS) attacks


definition_id: oval:org.debian:def:170728034156538880516083053726056048645
title: CVE-2014-3876 fex
description:
Multiple cross-site scripting (XSS) vulnerabilities in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allow remote attackers to inject arbitrary web script or HTML via the (1) akey parameter to rup or (2) disclaimer or (3) gm parameter to fuc.


definition_id: oval:org.debian:def:143057789415942267541785573954483144554
title: CVE-2014-3877 fex
description:
Incomplete blacklist vulnerability in Frams' Fast File EXchange (F*EX, aka fex) before fex-20140530 allows remote attackers to conduct cross-site scripting (XSS) attacks via the addto parameter to fup.


definition_id: oval:org.debian:def:334172689985161380351277018303670885140
title: CVE-2014-3880 kfreebsd-10
description:
The (1) execve and (2) fexecve system calls in the FreeBSD kernel 8.4 before p11, 9.1 before p14, 9.2 before p7, and 10.0 before p4 destroys the virtual memory address space and mappings for a process before all threads have terminated, which allows local users to cause a denial of service (triple-fault and system reboot) via a crafted system call, which triggers an invalid page table pointer dereference.


definition_id: oval:org.debian:def:102237305826673795708167909894617679554
title: CVE-2014-3917 linux
description:
kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.


definition_id: oval:org.debian:def:58842563845820338025375835689072784196
title: CVE-2014-3940 linux
description:
The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c.


definition_id: oval:org.debian:def:50349689806083563129878210772618233189
title: CVE-2014-3952 kfreebsd-10
description:
FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize the buffer between the header and data of a control message, which allows local users to obtain sensitive information from kernel memory via unspecified vectors.


definition_id: oval:org.debian:def:280994153400503943035266316238754642225
title: CVE-2014-3953 kfreebsd-10
description:
FreeBSD 8.4 before p14, 9.1 before p17, 9.2 before p10, and 10.0 before p7 does not properly initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via a (1) SCTP_SNDRCV, (2) SCTP_EXTRCV, or (3) SCTP_RCVINFO SCTP cmsg or a (4) SCTP_PEER_ADDR_CHANGE, (5) SCTP_REMOTE_ERROR, or (6) SCTP_AUTHENTICATION_EVENT notification.


definition_id: oval:org.debian:def:200367966183609788086352679960751896198
title: CVE-2014-3956 sendmail
description:
The sm_close_on_exec function in conf.c in sendmail before 8.14.9 has arguments in the wrong order, and consequently skips setting expected FD_CLOEXEC flags, which allows local users to access unintended high-numbered file descriptors via a custom mail-delivery program.


definition_id: oval:org.debian:def:283373561203959500990587748456842347707
title: CVE-2014-3966 mediawiki
description:
Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.


definition_id: oval:org.debian:def:124699843301667750695284822380985576019
title: CVE-2014-3967 xen
description:
The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x does not properly check the return value from the IRQ setup check, which allows local HVM guest administrators to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.


definition_id: oval:org.debian:def:286569839724477069650945842642480943278
title: CVE-2014-3968 xen
description:
The HVMOP_inject_msi function in Xen 4.2.x, 4.3.x, and 4.4.x allows local guest HVM administrators to cause a denial of service (host crash) via a large number of crafted requests, which trigger an error messages to be logged.


definition_id: oval:org.debian:def:216546568184002822903994926982641959858
title: CVE-2014-3970 pulseaudio
description:
The pa_rtp_recv function in modules/rtp/rtp.c in the module-rtp-recv module in PulseAudio 5.0 and earlier allows remote attackers to cause a denial of service (assertion failure and abort) via an empty UDP packet.


definition_id: oval:org.debian:def:144969804218923349050210394771790795003
title: CVE-2014-3985 miniupnpc
description:
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.


definition_id: oval:org.debian:def:289515655173147841196778537668769372213
title: CVE-2014-3986 lynis
description:
include/tests_webservers in Lynis before 1.5.5 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/lynis.*.unsorted file with an easily determined name.


definition_id: oval:org.debian:def:239582637092357440735070347249585362613
title: CVE-2014-3999 php-horde-ldap
description:
The Horde_Ldap library before 2.0.6 for Horde allows remote attackers to bypass authentication by leveraging knowledge of the LDAP bind user DN.


definition_id: oval:org.debian:def:74464587629069495295834763695032929648
title: CVE-2014-4000 cacti
description:
Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object, related to calling unserialize(stripslashes()).


definition_id: oval:org.debian:def:73596391953334260102991899004559668857
title: CVE-2014-4002 cacti
description:
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote attackers to inject arbitrary web script or HTML via the (1) drp_action parameter to cdef.php, (2) data_input.php, (3) data_queries.php, (4) data_sources.php, (5) data_templates.php, (6) graph_templates.php, (7) graphs.php, (8) host.php, or (9) host_templates.php or the (10) graph_template_input_id or (11) graph_template_id parameter to graph_templates_inputs.php.


definition_id: oval:org.debian:def:262733102972898686377784698895666030313
title: CVE-2014-4014 linux
description:
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.


definition_id: oval:org.debian:def:183399798062510057478071666440115050919
title: CVE-2014-4020 wireshark
description:
The dissect_frame function in epan/dissectors/packet-frame.c in the frame metadissector in Wireshark 1.10.x before 1.10.8 interprets a negative integer as a length value even though it was intended to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:222940989195882338177430170591818808170
title: CVE-2014-4021 xen
description:
Xen 3.2.x through 4.4.x does not properly clean memory pages recovered from guests, which allows local guest OS users to obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:322101117635597207237295882165096466618
title: CVE-2014-4027 linux
description:
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.


definition_id: oval:org.debian:def:324142371828839047726010852582438339142
title: CVE-2014-4038 ppc64-diag
description:
ppc64-diag 2.6.1 allows local users to overwrite arbitrary files via a symlink attack related to (1) rtas_errd/diag_support.c and /tmp/get_dt_files, (2) scripts/ppc64_diag_mkrsrc and /tmp/diagSEsnap/snapH.tar.gz, or (3) lpd/test/lpd_ela_test.sh and /var/tmp/ras.


definition_id: oval:org.debian:def:160324964802848218047151839571162479749
title: CVE-2014-4039 ppc64-diag
description:
ppc64-diag 2.6.1 uses 0775 permissions for /tmp/diagSEsnap and does not properly restrict permissions for /tmp/diagSEsnap/snapH.tar.gz, which allows local users to obtain sensitive information by reading files in this archive, as demonstrated by /var/log/messages and /etc/yaboot.conf.


definition_id: oval:org.debian:def:281540403456185690274291864809849086860
title: CVE-2014-4040 powerpc-utils
description:
snap in powerpc-utils 1.2.20 produces an archive with fstab and yaboot.conf files potentially containing cleartext passwords, and lacks a warning about reviewing this archive to detect included passwords, which might allow remote attackers to obtain sensitive information by leveraging access to a technical-support data stream.


definition_id: oval:org.debian:def:172014885043613413583065603241397356108
title: CVE-2014-4043 glibc
description:
The posix_spawn_file_actions_addopen function in glibc before 2.20 does not copy its path argument in accordance with the POSIX specification, which allows context-dependent attackers to trigger use-after-free vulnerabilities.


definition_id: oval:org.debian:def:55837070623009308813577372700303721179
title: CVE-2014-4044 openafs
description:
OpenAFS 1.6.8 does not properly clear the fields in the host structure, which allows remote attackers to cause a denial of service (uninitialized memory access and crash) via unspecified vectors related to TMAY requests.


definition_id: oval:org.debian:def:270754636804025739453637203982066605341
title: CVE-2014-4046 asterisk
description:
Asterisk Open Source 11.x before 11.10.1 and 12.x before 12.3.1 and Certified Asterisk 11.6 before 11.6-cert3 allows remote authenticated Manager users to execute arbitrary shell commands via a MixMonitor action.


definition_id: oval:org.debian:def:167556119346671985630798949024732058121
title: CVE-2014-4047 asterisk
description:
Asterisk Open Source 1.8.x before 1.8.28.1, 11.x before 11.10.1, and 12.x before 12.3.1 and Certified Asterisk 1.8.15 before 1.8.15-cert6 and 11.6 before 11.6-cert3 allows remote attackers to cause a denial of service (connection consumption) via a large number of (1) inactive or (2) incomplete HTTP connections.


definition_id: oval:org.debian:def:187716658070740787496549176860459658694
title: CVE-2014-4150 scheme48
description:
The scheme48-send-definition function in cmuscheme48.el in Scheme 48 allows local users to write to arbitrary files via a symlink attack on /tmp/s48lose.tmp.


definition_id: oval:org.debian:def:76264112088268776197535738170146450302
title: CVE-2014-4157 linux
description:
arch/mips/include/asm/thread_info.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure _TIF_SECCOMP checks on the fast system-call path, which allows local users to bypass intended PR_SET_SECCOMP restrictions by executing a crafted application without invoking a trace or audit subsystem.


definition_id: oval:org.debian:def:109730263121220549784423300464858976399
title: CVE-2014-4167 neutron
description:
The L3-agent in OpenStack Neutron before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated users to cause a denial of service (IPv4 address attachment outage) by attaching an IPv6 private subnet to a L3 router.


definition_id: oval:org.debian:def:337440364577535673610314176263385933178
title: CVE-2014-4168 iodine
description:
(1) iodined.c and (2) user.c in iodine before 0.7.0 allows remote attackers to bypass authentication by continuing execution after an error has been triggering.


definition_id: oval:org.debian:def:237896557768884901271863546704297453956
title: CVE-2014-4171 linux
description:
mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.


definition_id: oval:org.debian:def:108414493307994195730769747261833371087
title: CVE-2014-4172 php-cas
description:
A URL parameter injection vulnerability was found in the back-channel ticket validation step of the CAS protocol in Jasig Java CAS Client before 3.3.2, .NET CAS Client before 1.0.2, and phpCAS before 1.3.3 that allow remote attackers to inject arbitrary web script or HTML via the (1) service parameter to validation/AbstractUrlBasedTicketValidator.java or (2) pgtUrl parameter to validation/Cas20ServiceTicketValidator.java.


definition_id: oval:org.debian:def:288393801733321459611257424374700847263
title: CVE-2014-4174 wireshark
description:
wiretap/libpcap.c in the libpcap file parser in Wireshark 1.10.x before 1.10.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted packet-trace file that includes a large packet.


definition_id: oval:org.debian:def:279919976763822294795685073660104690526
title: CVE-2014-4199 open-vm-tools
description:
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.


definition_id: oval:org.debian:def:308759209800267775421820787811276897493
title: CVE-2014-4200 open-vm-tools
description:
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.


definition_id: oval:org.debian:def:98658186615517176606656408283024093086
title: CVE-2014-4329 ntopng
description:
Cross-site scripting (XSS) vulnerability in lua/host_details.lua in ntopng 1.1 allows remote attackers to inject arbitrary web script or HTML via the host parameter.


definition_id: oval:org.debian:def:226579013921699634314952347063389183620
title: CVE-2014-4330 perl
description:
The Dumper method in Data::Dumper before 2.154, as used in Perl 5.20.1 and earlier, allows context-dependent attackers to cause a denial of service (stack consumption and crash) via an Array-Reference with many nested Array-References, which triggers a large number of recursive calls to the DD_dump function.


definition_id: oval:org.debian:def:259648449581984945303512870228618538994
title: CVE-2014-4336 cups-filters
description:
The generate_local_queue function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote IPP printers to execute arbitrary commands via shell metacharacters in the host name.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2707.


definition_id: oval:org.debian:def:162658942353361423086834766905425960779
title: CVE-2014-4337 cups-filters
description:
The process_browse_data function in utils/cups-browsed.c in cups-browsed in cups-filters before 1.0.53 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via crafted packet data.


definition_id: oval:org.debian:def:37050142653103289089066405411740198885
title: CVE-2014-4338 cups-filters
description:
cups-browsed in cups-filters before 1.0.53 allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging a malformed cups-browsed.conf BrowseAllow directive that is interpreted as granting browse access to all IP addresses.


definition_id: oval:org.debian:def:300245406688229995101071938324722236537
title: CVE-2014-4341 krb5
description:
MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.


definition_id: oval:org.debian:def:253497044340908627968588147639013184422
title: CVE-2014-4342 krb5
description:
MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session.


definition_id: oval:org.debian:def:191959080020419975578620216272775146327
title: CVE-2014-4343 krb5
description:
Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.


definition_id: oval:org.debian:def:265897892447650846071857801972576375561
title: CVE-2014-4344 krb5
description:
The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.


definition_id: oval:org.debian:def:183106088069655633927780070244191608642
title: CVE-2014-4345 krb5
description:
Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x through 1.11.x before 1.11.6 and 1.12.x before 1.12.2 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of "cpw -keepold" commands.


definition_id: oval:org.debian:def:260286637030195998840297106041169783471
title: CVE-2014-4508 linux
description:
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.


definition_id: oval:org.debian:def:188247633920627649282072277805405687674
title: CVE-2014-4510 apt-cacher-ng
description:
Cross-site scripting (XSS) vulnerability in job.cc in apt-cacher-ng 0.7.26 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.


definition_id: oval:org.debian:def:61091427649516851721855656215830178291
title: CVE-2014-4607 busybox
description:
Integer overflow in the LZO algorithm variant in Oberhumer liblzo2 and lzo-2 before 2.07 on 32-bit platforms might allow remote attackers to execute arbitrary code via a crafted Literal Run.


definition_id: oval:org.debian:def:292080623361134464170110508869054915673
title: CVE-2014-4608 linux
description:
** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run.  NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype."


definition_id: oval:org.debian:def:255162727256373126338739516654727888705
title: CVE-2014-4610 ffmpeg
description:
Integer overflow in the get_len function in libavutil/lzo.c in FFmpeg before 0.10.14, 1.1.x before 1.1.12, 1.2.x before 1.2.7, 2.0.x before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.4 allows remote attackers to execute arbitrary code via a crafted Literal Run.


definition_id: oval:org.debian:def:323666764656191311238169219575146709324
title: CVE-2014-4611 linux
description:
Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.


definition_id: oval:org.debian:def:274661555856612124170316660160695533628
title: CVE-2014-4615 ceilometer
description:
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).


definition_id: oval:org.debian:def:240513126165523796723613005666186211117
title: CVE-2014-4616 python2.7
description:
Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.


definition_id: oval:org.debian:def:213861832900313015573585382985185814623
title: CVE-2014-4617 gnupg2
description:
The do_uncompress function in g10/compress.c in GnuPG 1.x before 1.4.17 and 2.x before 2.0.24 allows context-dependent attackers to cause a denial of service (infinite loop) via malformed compressed packets, as demonstrated by an a3 01 5b ff byte sequence.


definition_id: oval:org.debian:def:278177335518159926636862644239411375089
title: CVE-2014-4650 python2.7
description:
The CGIHTTPServer module in Python 2.7.5 and 3.3.4 does not properly handle URLs in which URL encoding is used for path separators, which allows remote attackers to read script source code or conduct directory traversal attacks and execute unintended code via a crafted character sequence, as demonstrated by a %2f separator.


definition_id: oval:org.debian:def:55900226998128926668127664770908089002
title: CVE-2014-4652 linux
description:
Race condition in the tlv handler functionality in the snd_ctl_elem_user_tlv function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allows local users to obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.


definition_id: oval:org.debian:def:126319410725000238780331987244437888082
title: CVE-2014-4653 linux
description:
sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.


definition_id: oval:org.debian:def:263437443893281753691053608258261093794
title: CVE-2014-4654 linux
description:
The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.


definition_id: oval:org.debian:def:89944981856596148182121319131143036407
title: CVE-2014-4655 linux
description:
The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.


definition_id: oval:org.debian:def:175322310893960774025786181841146847295
title: CVE-2014-4656 linux
description:
Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.


definition_id: oval:org.debian:def:17310622082095926526331106502234980003
title: CVE-2014-4657 ansible
description:
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.


definition_id: oval:org.debian:def:128743777652525661947637379875497229768
title: CVE-2014-4658 ansible
description:
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.


definition_id: oval:org.debian:def:131645350133559934737541113285841157725
title: CVE-2014-4659 ansible
description:
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.


definition_id: oval:org.debian:def:338396954166684760587045650052642641680
title: CVE-2014-4660 ansible
description:
Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format.


definition_id: oval:org.debian:def:237250017340091617498992896871985503635
title: CVE-2014-4667 linux
description:
The sctp_association_free function in net/sctp/associola.c in the Linux kernel before 3.15.2 does not properly manage a certain backlog value, which allows remote attackers to cause a denial of service (socket outage) via a crafted SCTP packet.


definition_id: oval:org.debian:def:269050156563909052380231538811638017592
title: CVE-2014-4678 ansible
description:
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.


definition_id: oval:org.debian:def:266324814482923087823180817411746551473
title: CVE-2014-4699 linux
description:
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.


definition_id: oval:org.debian:def:8027821763252942475282070553178287986
title: CVE-2014-4715 lz4
description:
Yann Collet LZ4 before r119, when used on certain 32-bit platforms that allocate memory beyond 0x80000000, does not properly detect integer overflows, which allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run, a different vulnerability than CVE-2014-4611.


definition_id: oval:org.debian:def:140865422492151777338233257475699654663
title: CVE-2014-4720 libemail-address-perl
description:
Email::Address module before 1.904 for Perl uses an inefficient regular expression, which allows remote attackers to cause a denial of service (CPU consumption) via vectors related to "backtracking into the phrase," a different vulnerability than CVE-2014-0477.


definition_id: oval:org.debian:def:32542245026947162042891980042424558222
title: CVE-2014-4877 wget
description:
Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled, allows remote FTP servers to write to arbitrary files, and consequently execute arbitrary code, via a LIST response that references the same filename within two entries, one of which indicates that the filename is for a symlink.


definition_id: oval:org.debian:def:172537415633313901222680232044913745065
title: CVE-2014-4909 transmission
description:
Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:80194621177828850248876946687722337367
title: CVE-2014-4943 linux
description:
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.


definition_id: oval:org.debian:def:225545662358509348588280675768177670057
title: CVE-2014-4945 php-horde-imp
description:
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via an unspecified flag in the basic (1) mailbox or (2) message view.


definition_id: oval:org.debian:def:122946771267747102594518024010923090517
title: CVE-2014-4946 php-horde-imp
description:
Multiple cross-site scripting (XSS) vulnerabilities in Horde Internet Mail Program (IMP) before 6.1.8, as used in Horde Groupware Webmail Edition before 5.1.5, allow remote attackers to inject arbitrary web script or HTML via (1) unspecified flags or (2) a mailbox name in the dynamic mailbox view.


definition_id: oval:org.debian:def:165367163240555475060970274497124103090
title: CVE-2014-4966 ansible
description:
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.


definition_id: oval:org.debian:def:333860392588465449671724304329507596636
title: CVE-2014-4967 ansible
description:
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.


definition_id: oval:org.debian:def:187240412518841525373029245533533652946
title: CVE-2014-5025 cacti
description:
Cross-site scripting (XSS) vulnerability in data_sources.php in Cacti 0.8.8b allows remote authenticated users with console access to inject arbitrary web script or HTML via the name_cache parameter in a ds_edit action.


definition_id: oval:org.debian:def:300676868891524434625305930545773125582
title: CVE-2014-5026 cacti
description:
Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow remote authenticated users with console access to inject arbitrary web script or HTML via a (1) Graph Tree Title in a delete or (2) edit action; (3) CDEF Name, (4) Data Input Method Name, or (5) Host Templates Name in a delete action; (6) Data Source Title; (7) Graph Title; or (8) Graph Template Name in a delete or (9) duplicate action.


definition_id: oval:org.debian:def:306756101595999819209975772223584548767
title: CVE-2014-5029 cups
description:
The web interface in CUPS 1.7.4 allows local users in the lp group to read arbitrary files via a symlink attack on a file in /var/cache/cups/rss/ and language[0] set to null.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-3537.


definition_id: oval:org.debian:def:116859769595186615470706969997707046858
title: CVE-2014-5030 cups
description:
CUPS before 2.0 allows local users to read arbitrary files via a symlink attack on (1) index.html, (2) index.class, (3) index.pl, (4) index.php, (5) index.pyc, or (6) index.py.


definition_id: oval:org.debian:def:336629000172671250450231847100409844388
title: CVE-2014-5031 cups
description:
The web interface in CUPS before 2.0 does not check that files have world-readable permissions, which allows remote attackers to obtains sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:274284344515370946939538357633561800201
title: CVE-2014-5033 kde4libs
description:
KDE kdelibs before 4.14 and kauth before 5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, related to CVE-2013-4288 and "PID reuse race conditions."


definition_id: oval:org.debian:def:21716359232918930326355762689449314474
title: CVE-2014-5045 linux
description:
The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.


definition_id: oval:org.debian:def:327059935170235649372924193291164339008
title: CVE-2014-5077 linux
description:
A NULL pointer dereference flaw was found in the way the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation handled simultaneous connections between the same hosts. A remote attacker could use this flaw to crash the system.


definition_id: oval:org.debian:def:259422737758527487395568062601008126783
title: CVE-2014-5117 tor
description:
Tor before 0.2.4.23 and 0.2.5 before 0.2.5.6-alpha maintains a circuit after an inbound RELAY_EARLY cell is received by a client, which makes it easier for remote attackers to conduct traffic-confirmation attacks by using the pattern of RELAY and RELAY_EARLY cells as a means of communicating information about hidden service names.


definition_id: oval:org.debian:def:253895422579481224838622734532643984268
title: CVE-2014-5119 glibc
description:
An off-by-one heap-based buffer overflow flaw was found in glibc's internal __gconv_translit_find() function. An attacker able to make an application call the iconv_open() function with a specially crafted argument could possibly use this flaw to execute arbitrary code with the privileges of that application.


definition_id: oval:org.debian:def:220106812918775751602081950564353667720
title: CVE-2014-5139 openssl
description:
The ssl_set_client_disabled function in t1_lib.c in OpenSSL 1.0.1 before 1.0.1i allows remote SSL servers to cause a denial of service (NULL pointer dereference and client application crash) via a ServerHello message that includes an SRP ciphersuite without the required negotiation of that ciphersuite with the client.


definition_id: oval:org.debian:def:254244165962790033107039779439612334272
title: CVE-2014-5146 xen
description:
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x before the xsa97-hap patch, when using Hardware Assisted Paging (HAP), are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5149.


definition_id: oval:org.debian:def:294075610232748047555885515263410609144
title: CVE-2014-5147 xen
description:
Xen 4.4.x, when running a 64-bit kernel on an ARM system, does not properly handle traps from the guest domain that use a different address width, which allows local guest users to cause a denial of service (host crash) via a crafted 32-bit process.


definition_id: oval:org.debian:def:46184722792979417754181582215083047859
title: CVE-2014-5148 xen
description:
Xen 4.4.x, when running on an ARM system and "handling an unknown system register access from 64-bit userspace," returns to an instruction of the trap handler for kernel space faults instead of an instruction that is associated with faults in 64-bit userspace, which allows local guest users to cause a denial of service (crash) and possibly gain privileges via a crafted process.


definition_id: oval:org.debian:def:179977874020841730265055616800511085235
title: CVE-2014-5149 xen
description:
Certain MMU virtualization operations in Xen 4.2.x through 4.4.x, when using shadow pagetables, are not preemptible, which allows local HVM guest to cause a denial of service (vcpu consumption) by invoking these operations, which process every page assigned to a guest, a different vulnerability than CVE-2014-5146.


definition_id: oval:org.debian:def:124974884011783877650125416238495977870
title: CVE-2014-5161 wireshark
description:
The dissect_log function in plugins/irda/packet-irda.c in the IrDA dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' characters, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:128015523090625195319391770164071287833
title: CVE-2014-5162 wireshark
description:
The read_new_line function in wiretap/catapult_dct2000.c in the Catapult DCT2000 dissector in Wireshark 1.10.x before 1.10.9 does not properly strip '\n' and '\r' characters, which allows remote attackers to cause a denial of service (off-by-one buffer underflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:262911116392576046781369741129966291009
title: CVE-2014-5163 wireshark
description:
The APN decode functionality in (1) epan/dissectors/packet-gtp.c and (2) epan/dissectors/packet-gsm_a_gm.c in the GTP and GSM Management dissectors in Wireshark 1.10.x before 1.10.9 does not completely initialize a certain buffer, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:129383242008712324011817582095797646900
title: CVE-2014-5164 wireshark
description:
The rlc_decode_li function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.10.x before 1.10.9 initializes a certain structure member only after this member is used, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:315623809457230073739694214929743343981
title: CVE-2014-5165 wireshark
description:
The dissect_ber_constrained_bitstring function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.10.x before 1.10.9 does not properly validate padding values, which allows remote attackers to cause a denial of service (buffer underflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:54315486361582439964223142901259257641
title: CVE-2014-5177 libvirt
description:
libvirt 1.0.0 through 1.2.x before 1.2.5, when fine grained access control is enabled, allows local users to read arbitrary files via a crafted XML document containing an XML external entity declaration in conjunction with an entity reference to the (1) virDomainDefineXML, (2) virNetworkCreateXML, (3) virNetworkDefineXML, (4) virStoragePoolCreateXML, (5) virStoragePoolDefineXML, (6) virStorageVolCreateXML, (7) virDomainCreateXML, (8) virNodeDeviceCreateXML, (9) virInterfaceDefineXML, (10) virStorageVolCreateXMLFrom, (11) virConnectDomainXMLFromNative, (12) virConnectDomainXMLToNative, (13) virSecretDefineXML, (14) virNWFilterDefineXML, (15) virDomainSnapshotCreateXML, (16) virDomainSaveImageDefineXML, (17) virDomainCreateXMLWithFiles, (18) virConnectCompareCPU, or (19) virConnectBaselineCPU API method, related to an XML External Entity (XXE) issue.  NOTE: this issue was SPLIT from CVE-2014-0179 per ADT3 due to different affected versions of some vectors.


definition_id: oval:org.debian:def:320130831810637307387025133530971543460
title: CVE-2014-5191 ckeditor
description:
Cross-site scripting (XSS) vulnerability in the Preview plugin before 4.4.3 in CKEditor allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:102638090864359025127097587379136555131
title: CVE-2014-5203 wordpress
description:
wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data.


definition_id: oval:org.debian:def:110796818435377085174772068614141283840
title: CVE-2014-5204 wordpress
description:
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.


definition_id: oval:org.debian:def:284956640780373025896714266968419782140
title: CVE-2014-5205 wordpress
description:
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack.


definition_id: oval:org.debian:def:75115810299052236286904713158285057893
title: CVE-2014-5206 linux
description:
The do_remount function in fs/namespace.c in the Linux kernel through 3.16.1 does not maintain the MNT_LOCK_READONLY bit across a remount of a bind mount, which allows local users to bypass an intended read-only restriction and defeat certain sandbox protection mechanisms via a "mount -o remount" command within a user namespace.


definition_id: oval:org.debian:def:211485193555953212711483027170720490056
title: CVE-2014-5207 linux
description:
fs/namespace.c in the Linux kernel through 3.16.1 does not properly restrict clearing MNT_NODEV, MNT_NOSUID, and MNT_NOEXEC and changing MNT_ATIME_MASK during a remount of a bind mount, which allows local users to gain privileges, interfere with backups and auditing on systems that had atime enabled, or cause a denial of service (excessive filesystem updating) on systems that had atime disabled via a "mount -o remount" command within a user namespace.


definition_id: oval:org.debian:def:110905010343951244341148122966694820148
title: CVE-2014-5209 ntp
description:
An Information Disclosure vulnerability exists in NTP 4.2.7p25 private (mode 6/7) messages via a GET_RESTRICT control message, which could let a malicious user obtain sensitive information.


definition_id: oval:org.debian:def:170854312642793505889844673296467139835
title: CVE-2014-5220 mdadm
description:
The mdcheck script of the mdadm package for openSUSE 13.2 prior to version 3.3.1-5.14.1 does not properly sanitize device names, which allows local attackers to execute arbitrary commands as root.


definition_id: oval:org.debian:def:233266594557142476467896863652160621042
title: CVE-2014-5240 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL.


definition_id: oval:org.debian:def:283011134336996997425268641464485505888
title: CVE-2014-5241 mediawiki
description:
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set.


definition_id: oval:org.debian:def:321370701583167295827725287130006860091
title: CVE-2014-5243 mediawiki
description:
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.


definition_id: oval:org.debian:def:33740310863725950783024610993962731414
title: CVE-2014-5247 ganeti
description:
The _UpgradeBeforeConfigurationChange function in lib/client/gnt_cluster.py in Ganeti 2.10.0 before 2.10.7 and 2.11.0 before 2.11.5 uses world-readable permissions for the configuration backup file, which allows local users to obtain SSL keys, remote API credentials, and other sensitive information by reading the file, related to the upgrade command.


definition_id: oval:org.debian:def:153118250043671633464644886647003471660
title: CVE-2014-5251 keystone
description:
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.


definition_id: oval:org.debian:def:323935885860184526047002227903882583401
title: CVE-2014-5252 keystone
description:
The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.


definition_id: oval:org.debian:def:179945504084255457824212264408227389966
title: CVE-2014-5253 keystone
description:
OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.


definition_id: oval:org.debian:def:337734901924705282365259455609156200147
title: CVE-2014-5254 xcfa
description:
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files.


definition_id: oval:org.debian:def:292808480661698964785816919641364513322
title: CVE-2014-5255 xcfa
description:
xcfa before 5.0.1 creates temporary files insecurely which could allow local users to launch a symlink attack and overwrite arbitrary files. Note: A different vulnerability than CVE-2014-5254.


definition_id: oval:org.debian:def:207042029912792376332044737325619701616
title: CVE-2014-5256 nodejs
description:
Node.js 0.8 before 0.8.28 and 0.10 before 0.10.30 does not consider the possibility of recursive processing that triggers V8 garbage collection in conjunction with a V8 interrupt, which allows remote attackers to cause a denial of service (memory corruption and application crash) via deep JSON objects whose parsing lets this interrupt mask an overflow of the program stack.


definition_id: oval:org.debian:def:290165158391930852433239630439113374738
title: CVE-2014-5260 libxml-dt-perl
description:
The (1) mkxmltype and (2) mkdtskel scripts in XML-DT before 0.64 allow local users to overwrite arbitrary files via a symlink attack on a /tmp/_xml_##### temporary file.


definition_id: oval:org.debian:def:206711645688000559561726027691078006310
title: CVE-2014-5261 cacti
description:
The graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a font size, related to the rrdtool commandline in lib/rrd.php.


definition_id: oval:org.debian:def:104824337038072405747778387371270581333
title: CVE-2014-5262 cacti
description:
SQL injection vulnerability in the graph settings script (graph_settings.php) in Cacti 0.8.8b and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:320873538923897869107274072361586081993
title: CVE-2014-5263 qemu
description:
vmstate_xhci_event in hw/usb/hcd-xhci.c in QEMU 1.6.0 does not terminate the list with the VMSTATE_END_OF_LIST macro, which allows attackers to cause a denial of service (out-of-bounds access, infinite loop, and memory corruption) and possibly gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:232904564122650261342825600050421125928
title: CVE-2014-5265 wordpress
description:
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations without considering recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:231843101865247921075344629824119310932
title: CVE-2014-5266 wordpress
description:
The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of elements in an XML document, which allows remote attackers to cause a denial of service (CPU consumption) via a large document, a different vulnerability than CVE-2014-5265.


definition_id: oval:org.debian:def:272442722122815086099395963265991121473
title: CVE-2014-5269 libplack-perl
description:
Plack::App::File in Plack before 1.0031 removes trailing slash characters from paths, which allows remote attackers to bypass the whitelist of generated files and obtain sensitive information via a crafted path, related to Plack::Middleware::Static.


definition_id: oval:org.debian:def:5875384140572142286293409603205829538
title: CVE-2014-5270 libgcrypt20
description:
Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.


definition_id: oval:org.debian:def:204725626377781805528509537098998907134
title: CVE-2014-5272 ffmpeg
description:
libavcodec/iff.c in FFMpeg before 1.1.14, 1.2.x before 1.2.8, 2.2.x before 2.2.7, and 2.3.x before 2.3.2 allows remote attackers to have unspecified impact via a crafted iff image, which triggers an out-of-bounds array access, related to the rgb8 and rgbn formats.


definition_id: oval:org.debian:def:214234697276588987117782328644097901983
title: CVE-2014-5277 docker.io
description:
Docker before 1.3.1 and docker-py before 0.5.3 fall back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic.


definition_id: oval:org.debian:def:270223768339045794965424063228017951653
title: CVE-2014-5278 docker.io
description:
A vulnerability exists in Docker before 1.2 via container names, which may collide with and override container IDs.


definition_id: oval:org.debian:def:752453357110266596675638697448462826
title: CVE-2014-5282 docker.io
description:
Docker before 1.3 does not properly validate image IDs, which allows remote attackers to redirect to another image through the loading of untrusted images via 'docker load'.


definition_id: oval:org.debian:def:222104140115224456845282584472096354187
title: CVE-2014-5351 krb5
description:
The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.


definition_id: oval:org.debian:def:328784438304126793379882171108812254633
title: CVE-2014-5352 krb5
description:
The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind.


definition_id: oval:org.debian:def:236463953384499986281208092759223929799
title: CVE-2014-5353 krb5
description:
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.


definition_id: oval:org.debian:def:140939225620209592551461068954155546794
title: CVE-2014-5354 krb5
description:
plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command.


definition_id: oval:org.debian:def:26195554424576269267525252135442795251
title: CVE-2014-5355 krb5
description:
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c.


definition_id: oval:org.debian:def:124500579897202431770394921743380261432
title: CVE-2014-5356 glance
description:
OpenStack Image Registry and Delivery Service (Glance) before 2013.2.4, 2014.x before 2014.1.3, and Juno before Juno-3, when using the V2 API, does not properly enforce the image_size_cap configuration option, which allows remote authenticated users to cause a denial of service (disk consumption) by uploading a large image.


definition_id: oval:org.debian:def:15008142208023449348803078691399101225
title: CVE-2014-5369 enigmail
description:
Enigmail 1.7.x before 1.7.2 sends emails in plaintext when encryption is enabled and only BCC recipients are specified, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:17531478725247772934597020719403701369
title: CVE-2014-5388 qemu
description:
Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.


definition_id: oval:org.debian:def:139360961437963937633673634587708251727
title: CVE-2014-5439 sniffit
description:
Multiple Stack-based Buffer Overflow vulnerabilities exists in Sniffit prior to 0.3.7 via a crafted configuration file that will bypass Non-eXecutable bit NX, stack smashing protector SSP, and address space layout randomization ASLR protection mechanisms, which could let a malicious user execute arbitrary code.


definition_id: oval:org.debian:def:127605838533648295969084898254979932722
title: CVE-2014-5444 geary
description:
Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.


definition_id: oval:org.debian:def:234117356143500136727640966241388462277
title: CVE-2014-5461 lua5.1
description:
Buffer overflow in the vararg functions in ldo.c in Lua 5.1 through 5.2.x before 5.2.3 allows context-dependent attackers to cause a denial of service (crash) via a small number of arguments to a function with a large number of fixed arguments.


definition_id: oval:org.debian:def:220010817313969187688281969093173263257
title: CVE-2014-5464 ntopng
description:
Cross-site scripting (XSS) vulnerability in the nDPI traffic classification library in ntopng (aka ntop) before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the HTTP Host header.


definition_id: oval:org.debian:def:321413276502468872519433326717125624586
title: CVE-2014-5471 linux
description:
Stack consumption vulnerability in the parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (uncontrolled recursion, and system crash or reboot) via a crafted iso9660 image with a CL entry referring to a directory entry that has a CL entry.


definition_id: oval:org.debian:def:278435261097747763891944323138467194098
title: CVE-2014-5472 linux
description:
The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.


definition_id: oval:org.debian:def:129422324382826912506131932805586602127
title: CVE-2014-6040 glibc
description:
An out-of-bounds read flaw was found in the way glibc's iconv() function converted certain encoded data to UTF-8. An attacker able to make an application call the iconv() function with a specially crafted argument could use this flaw to crash that application.


definition_id: oval:org.debian:def:299196714190484593058046967775024206175
title: CVE-2014-6051 libvncserver
description:
Integer overflow in the MallocFrameBuffer function in vncviewer.c in LibVNCServer 0.9.9 and earlier allows remote VNC servers to cause a denial of service (crash) and possibly execute arbitrary code via an advertisement for a large screen size, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:99864538049506636631262127532863941304
title: CVE-2014-6052 libvncserver
description:
The HandleRFBServerMessage function in libvncclient/rfbproto.c in LibVNCServer 0.9.9 and earlier does not check certain malloc return values, which allows remote VNC servers to cause a denial of service (application crash) or possibly execute arbitrary code by specifying a large screen size in a (1) FramebufferUpdate, (2) ResizeFrameBuffer, or (3) PalmVNCReSizeFrameBuffer message.


definition_id: oval:org.debian:def:179921454141481875154664427807829617991
title: CVE-2014-6053 libvncserver
description:
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc.


definition_id: oval:org.debian:def:303004532179086878420773299952462553404
title: CVE-2014-6054 libvncserver
description:
The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier allows remote attackers to cause a denial of service (divide-by-zero error and server crash) via a zero value in the scaling factor in a (1) PalmVNCSetScaleFactor or (2) SetScale message.


definition_id: oval:org.debian:def:778123127228799859223631393133046492
title: CVE-2014-6055 libvncserver
description:
Multiple stack-based buffer overflows in the File Transfer feature in rfbserver.c in LibVNCServer 0.9.9 and earlier allow remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long file or (2) directory name or the (3) FileTime attribute in a rfbFileTransferOffer message.


definition_id: oval:org.debian:def:19355339277880869406692477144322672796
title: CVE-2014-6060 dhcpcd5
description:
The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again.


definition_id: oval:org.debian:def:310924964574385400469672043982987439381
title: CVE-2014-6070 loganalyzer
description:
Multiple cross-site scripting (XSS) vulnerabilities in Adiscon LogAnalyzer before 3.6.6 allow remote attackers to inject arbitrary web script or HTML via the hostname in (1) index.php or (2) detail.php.


definition_id: oval:org.debian:def:74140555454349792471221663680792919706
title: CVE-2014-6071 jquery
description:
jQuery 1.4.2 allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to use of the text method inside after.


definition_id: oval:org.debian:def:100329511922142373153102003250943939342
title: CVE-2014-6262 rrdtool
description:
Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss Core before 4.2.5 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted third argument to the rrdtool.graph function, aka ZEN-15415, a related issue to CVE-2013-2131.


definition_id: oval:org.debian:def:196040956827425675607211023335691813669
title: CVE-2014-6268 xen
description:
The evtchn_fifo_set_pending function in Xen 4.4.x allows local guest users to cause a denial of service (host crash) via vectors involving an uninitialized FIFO-based event channel control block when (1) binding or (2) moving an event to a different VCPU.


definition_id: oval:org.debian:def:321673165894534777498594472066411853348
title: CVE-2014-6269 haproxy
description:
Multiple integer overflows in the http_request_forward_body function in proto_http.c in HAProxy 1.5-dev23 before 1.5.4 allow remote attackers to cause a denial of service (crash) via a large stream of data, which triggers a buffer overflow and an out-of-bounds read.


definition_id: oval:org.debian:def:244710891599983058357010565490260399375
title: CVE-2014-6270 squid
description:
Off-by-one error in the snmpHandleUdp function in snmp_core.cc in Squid 2.x and 3.x, when an SNMP port is configured, allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted UDP SNMP request, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:3292190206821031402112610184765158083
title: CVE-2014-6271 bash
description:
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock."  NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.


definition_id: oval:org.debian:def:88574457619140775567546041580773883721
title: CVE-2014-6272 libevent
description:
Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow context-dependent attackers to cause a denial of service or possibly have other unspecified impact via "insanely large inputs" to the (1) evbuffer_add, (2) evbuffer_expand, or (3) bufferevent_write function, which triggers a heap-based buffer overflow or an infinite loop.  NOTE: this identifier has been SPLIT per ADT3 due to different affected versions. See CVE-2015-6525 for the functions that are only affected in 2.0 and later.


definition_id: oval:org.debian:def:256634015785351151570241869440893969026
title: CVE-2014-6273 apt
description:
Buffer overflow in the HTTP transport code in apt-get in APT 1.0.1 and earlier allows man-in-the-middle attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted URL.


definition_id: oval:org.debian:def:315129463985860257881671541877862539410
title: CVE-2014-6277 bash
description:
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized memory access, and untrusted-pointer read and write operations) via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271 and CVE-2014-7169.


definition_id: oval:org.debian:def:244324426878531904238761352004933992455
title: CVE-2014-6278 bash
description:
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.


definition_id: oval:org.debian:def:105657824940577546493378892782738306619
title: CVE-2014-6311 ace
description:
generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file names in the /tmp directory which allows attackers to gain elevated privileges.


definition_id: oval:org.debian:def:44743540952158921291967700783275666694
title: CVE-2014-6393 node-express
description:
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.


definition_id: oval:org.debian:def:305152368761851892783964637338968409166
title: CVE-2014-6394 node-send
description:
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.


definition_id: oval:org.debian:def:168228732142913907831123319821121443404
title: CVE-2014-6395 ettercap
description:
Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.


definition_id: oval:org.debian:def:249934304060601427234822630693496668757
title: CVE-2014-6396 ettercap
description:
The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.


definition_id: oval:org.debian:def:231173473650634342391879723853833642485
title: CVE-2014-6407 docker.io
description:
Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.


definition_id: oval:org.debian:def:284386134559145471277404133020643017767
title: CVE-2014-6408 docker.io
description:
Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image.


definition_id: oval:org.debian:def:108983197557727102100732452521886293300
title: CVE-2014-6410 linux
description:
The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.


definition_id: oval:org.debian:def:16510445224550773485423731812096656865
title: CVE-2014-6414 neutron
description:
OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors.


definition_id: oval:org.debian:def:199935348314223910733448219835144087022
title: CVE-2014-6416 linux
description:
Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket.


definition_id: oval:org.debian:def:272218753896036211660955414117493274616
title: CVE-2014-6417 linux
description:
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.


definition_id: oval:org.debian:def:14316186283440501028673457876865409272
title: CVE-2014-6418 linux
description:
net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor.


definition_id: oval:org.debian:def:157166048463334851077275062549073048759
title: CVE-2014-6421 wireshark
description:
Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors.


definition_id: oval:org.debian:def:190660379305941512892696901531671179187
title: CVE-2014-6422 wireshark
description:
The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector.


definition_id: oval:org.debian:def:70012986785459896630197315357061843037
title: CVE-2014-6423 wireshark
description:
The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line.


definition_id: oval:org.debian:def:28001344768781831977686504390019611167
title: CVE-2014-6424 wireshark
description:
The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet.


definition_id: oval:org.debian:def:133375122016230809753264909999083950277
title: CVE-2014-6425 wireshark
description:
The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\0' character.


definition_id: oval:org.debian:def:5804347460417475034575868387726082985
title: CVE-2014-6426 wireshark
description:
The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:337061979118992433918957373690849253982
title: CVE-2014-6427 wireshark
description:
Off-by-one error in the is_rtsp_request_or_reply function in epan/dissectors/packet-rtsp.c in the RTSP dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers parsing of a token located one position beyond the current position.


definition_id: oval:org.debian:def:158158716699230341194093536177043564381
title: CVE-2014-6428 wireshark
description:
The dissect_spdu function in epan/dissectors/packet-ses.c in the SES dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not initialize a certain ID value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:260802463372939064772444851475741421423
title: CVE-2014-6429 wireshark
description:
The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not properly handle empty input data, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:271440732837381906287145355416171372631
title: CVE-2014-6430 wireshark
description:
The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not validate bitmask data, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:43742150514457973118337724558249098530
title: CVE-2014-6431 wireshark
description:
Buffer overflow in the SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (application crash) via a crafted file that triggers writes of uncompressed bytes beyond the end of the output buffer.


definition_id: oval:org.debian:def:306989256473713833690468631796685038863
title: CVE-2014-6432 wireshark
description:
The SnifferDecompress function in wiretap/ngsniffer.c in the DOS Sniffer file parser in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 does not prevent data overwrites during copy operations, which allows remote attackers to cause a denial of service (application crash) via a crafted file.


definition_id: oval:org.debian:def:29015298775906428535137332355237750143
title: CVE-2014-6440 vlc
description:
VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.


definition_id: oval:org.debian:def:126431611279831835209876811401869263290
title: CVE-2014-6540 virtualbox-guest-additions-iso
description:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization VirtualBox before 4.1.34, before 4.2.26, and before 4.3.14 allows local users to affect availability via vectors related to Graphics driver (WDDM) for Windows guests.


definition_id: oval:org.debian:def:318519048415888706461623222152517453314
title: CVE-2014-6585 icu
description:
Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6591.


definition_id: oval:org.debian:def:70578830826520742802165866446962300505
title: CVE-2014-6591 icu
description:
Unspecified vulnerability in the Java SE component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25 allows remote attackers to affect confidentiality via unknown vectors related to 2D, a different vulnerability than CVE-2014-6585.


definition_id: oval:org.debian:def:187056811824665641653515381375994305433
title: CVE-2014-6603 suricata
description:
The SSHParseBanner function in SSH parser (app-layer-ssh.c) in Suricata before 2.0.4 allows remote attackers to bypass SSH rules, cause a denial of service (crash), or possibly have unspecified other impact via a crafted banner, which triggers a large memory allocation or an out-of-bounds write.


definition_id: oval:org.debian:def:91199985072461016092202141114123562836
title: CVE-2014-6610 asterisk
description:
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application.


definition_id: oval:org.debian:def:294889360565165874540104984179823586019
title: CVE-2014-6633 tryton-server
description:
The safe_eval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in (1) the collection.domain in the webdav module or (2) the formula field in the price_list module.


definition_id: oval:org.debian:def:183206483490885019587144966349721760426
title: CVE-2014-7141 squid
description:
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.


definition_id: oval:org.debian:def:298180167250769120448671254550511999632
title: CVE-2014-7142 squid
description:
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.


definition_id: oval:org.debian:def:264863740357151407934890915245118636837
title: CVE-2014-7144 python-keystoneclient
description:
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.


definition_id: oval:org.debian:def:115644294456342183096558746391890651049
title: CVE-2014-7145 linux
description:
The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.


definition_id: oval:org.debian:def:151259562760014928063078525450786548576
title: CVE-2014-7154 xen
description:
Race condition in HVMOP_track_dirty_vram in Xen 4.0.0 through 4.4.x does not ensure possession of the guarding lock for dirty video RAM tracking, which allows certain local guest domains to cause a denial of service via unspecified vectors.


definition_id: oval:org.debian:def:111328947980622020921777087288077989847
title: CVE-2014-7155 xen
description:
The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 4.4.x and earlier does not properly check supervisor mode permissions, which allows local HVM users to cause a denial of service (guest crash) or gain guest kernel mode privileges via vectors involving an (1) HLT, (2) LGDT, (3) LIDT, or (4) LMSW instruction.


definition_id: oval:org.debian:def:9226957437528858191435578880117597044
title: CVE-2014-7156 xen
description:
The x86_emulate function in arch/x86/x86_emulate/x86_emulate.c in Xen 3.3.x through 4.4.x does not check the supervisor mode permissions for instructions that generate software interrupts, which allows local HVM guest users to cause a denial of service (guest crash) via unspecified vectors.


definition_id: oval:org.debian:def:121519047522372740608688629422917642563
title: CVE-2014-7169 bash
description:
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.


definition_id: oval:org.debian:def:157558299165067440906896292146651568225
title: CVE-2014-7185 python2.7
description:
Integer overflow in bufferobject.c in Python before 2.7.8 allows context-dependent attackers to obtain sensitive information from process memory via a large size and offset in a "buffer" function.


definition_id: oval:org.debian:def:170955819618549298638392054564913514418
title: CVE-2014-7186 bash
description:
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.


definition_id: oval:org.debian:def:304600251162559771627176835450446107350
title: CVE-2014-7187 bash
description:
Off-by-one error in the read_token_word function in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via deeply nested for loops, aka the "word_lineno" issue.


definition_id: oval:org.debian:def:314609718676788038783318498392940260485
title: CVE-2014-7188 xen
description:
The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in Xen 4.1 through 4.4.x uses an improper MSR range for x2APIC emulation, which allows local HVM guests to cause a denial of service (host crash) or read data from the hypervisor or other guests via unspecified vectors.


definition_id: oval:org.debian:def:212372116610392353594071779868100450192
title: CVE-2014-7191 node-qs
description:
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.


definition_id: oval:org.debian:def:47640819048996843479017598583339575279
title: CVE-2014-7199 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.


definition_id: oval:org.debian:def:237142547487887320928567411981463782294
title: CVE-2014-7202 zeromq3
description:
stream_engine.cpp in libzmq (aka ZeroMQ/C++)) 4.0.5 before 4.0.5 allows man-in-the-middle attackers to conduct downgrade attacks via a crafted connection request.


definition_id: oval:org.debian:def:119555355519026367229399205387153215908
title: CVE-2014-7203 zeromq3
description:
libzmq (aka ZeroMQ/C++) 4.0.x before 4.0.5 does not ensure that nonces are unique, which allows man-in-the-middle attackers to conduct replay attacks via unspecified vectors.


definition_id: oval:org.debian:def:243150465621581518001688693863596369539
title: CVE-2014-7204 exuberant-ctags
description:
jscript.c in Exuberant Ctags 5.8 allows remote attackers to cause a denial of service (infinite loop and CPU and disk consumption) via a crafted JavaScript file.


definition_id: oval:org.debian:def:47160736285515227098517337681678777448
title: CVE-2014-7206 apt
description:
The changelog command in Apt before 1.0.9.2 allows local users to write to arbitrary files via a symlink attack on the changelog file.


definition_id: oval:org.debian:def:39840433194693385416654720194745054390
title: CVE-2014-7208 gparted
description:
GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label.


definition_id: oval:org.debian:def:283422547805819124122027594431980216876
title: CVE-2014-7209 mime-support
description:
run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.


definition_id: oval:org.debian:def:307815420915302064489694867691864647846
title: CVE-2014-7230 cinder
description:
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.


definition_id: oval:org.debian:def:177843776432285257959827155096862270513
title: CVE-2014-7231 python-oslo.utils
description:
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.


definition_id: oval:org.debian:def:63106777993713936889293433130279349577
title: CVE-2014-7271 sddm
description:
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to log in as user "sddm" without authentication.


definition_id: oval:org.debian:def:59403005442521456646289384324351065530
title: CVE-2014-7272 sddm
description:
Simple Desktop Display Manager (SDDM) before 0.10.0 allows local users to gain root privileges because code running as root performs write operations within a user home directory, and this user may have created links in advance (exploitation requires the user to win a race condition in the ~/.Xauthority chown case, but not other cases).


definition_id: oval:org.debian:def:54159283380286865126742288810172673302
title: CVE-2014-7283 linux
description:
The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.


definition_id: oval:org.debian:def:336742888842026563386647620800053795784
title: CVE-2014-7284 linux
description:
The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.


definition_id: oval:org.debian:def:260530625849084968290420984925479086474
title: CVE-2014-7295 mediawiki
description:
The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.


definition_id: oval:org.debian:def:281053163615380135828429480177452825487
title: CVE-2014-7300 gnome-shell
description:
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer.


