# definitions

definition_id: oval:org.debian:def:232618809659917937412562289135433184947
title: CVE-2010-2546 libmikmod
description:
Multiple heap-based buffer overflows in loaders/load_it.c in libmikmod, possibly 3.1.12, might allow remote attackers to execute arbitrary code via (1) crafted samples or (2) crafted instrument definitions in an Impulse Tracker file, related to panpts, pitpts, and IT_ProcessEnvelope.  NOTE: some of these details are obtained from third party information.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-3995.


definition_id: oval:org.debian:def:158353732135489420686998696686618622152
title: CVE-2010-2575 okular
description:
Heap-based buffer overflow in the RLE decompression functionality in the TranscribePalmImageToJPEG function in generators/plucker/inplug/image.cpp in Okular in KDE SC 4.3.0 through 4.5.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted image in a PDB file.


definition_id: oval:org.debian:def:331607119775646141366631402262922783740
title: CVE-2010-2595 tiff
description:
The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to "downsampled OJPEG input."


definition_id: oval:org.debian:def:270775125102108059718657288357680199343
title: CVE-2010-2596 tiff
description:
The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and 3.9.2, as used in tiff2ps, allows remote attackers to cause a denial of service (assertion failure and application exit) via a crafted TIFF image, related to "downsampled OJPEG input."


definition_id: oval:org.debian:def:306093639521259982028738346693675820780
title: CVE-2010-2597 tiff
description:
The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to "downsampled OJPEG input" and possibly related to a compiler optimization that triggers a divide-by-zero error.


definition_id: oval:org.debian:def:244968436802447171853606822411528470909
title: CVE-2010-2598 tiff
description:
LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input."


definition_id: oval:org.debian:def:134175838725203990931548082352899724797
title: CVE-2010-2621 qt4-x11
description:
The QSslSocketBackendPrivate::transmit function in src_network_ssl_qsslsocket_openssl.cpp in Qt 4.6.3 and earlier allows remote attackers to cause a denial of service (infinite loop) via a malformed request.


definition_id: oval:org.debian:def:316111601694965724845187451888051947104
title: CVE-2010-2628 strongswan
description:
The IKE daemon in strongSwan 4.3.x before 4.3.7 and 4.4.x before 4.4.1 does not properly check the return values of snprintf calls, which allows remote attackers to execute arbitrary code via crafted (1) certificate or (2) identity data that triggers buffer overflows.


definition_id: oval:org.debian:def:75212048899174777326695812859366480726
title: CVE-2010-2630 tiff
description:
The TIFFReadDirectory function in LibTIFF 3.9.0 does not properly validate the data types of codec-specific tags that have an out-of-order position in a TIFF file, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.


definition_id: oval:org.debian:def:62607703485211908632354355734748600704
title: CVE-2010-2631 tiff
description:
LibTIFF 3.9.0 ignores tags in certain situations during the first stage of TIFF file processing and does not properly handle this during the second stage, which allows remote attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2010-2481.


definition_id: oval:org.debian:def:69801976681702188601887454261810381145
title: CVE-2010-2640 evince
description:
Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


definition_id: oval:org.debian:def:5728260454789654682260020219247567883
title: CVE-2010-2641 evince
description:
Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


definition_id: oval:org.debian:def:160601801650520272242031873295727591732
title: CVE-2010-2642 evince
description:
Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


definition_id: oval:org.debian:def:321830150872552893791950220648212376255
title: CVE-2010-2643 evince
description:
Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.


definition_id: oval:org.debian:def:934211359639009315691276446665882882
title: CVE-2010-2713 vte
description:
The vte_sequence_handler_window_manipulation function in vteseq.c in libvte (aka libvte9) in VTE 0.25.1 and earlier, as used in gnome-terminal, does not properly handle escape sequences, which allows remote attackers to execute arbitrary commands or obtain potentially sensitive information via a (1) window title or (2) icon title sequence.  NOTE: this issue exists because of a CVE-2003-0070 regression.


definition_id: oval:org.debian:def:157220221006936419222811563970718367501
title: CVE-2010-2725 barnowl
description:
BarnOwl before 1.6.2 does not check the return code of calls to the (1) ZPending and (2) ZReceiveNotice functions in libzephyr, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:49770844311075588387346406192512635105
title: CVE-2010-2761 libcgi-pm-perl
description:
The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172.


definition_id: oval:org.debian:def:230969160505008595767386532725136583610
title: CVE-2010-2785 kvirc
description:
The IRC Protocol component in KVIrc 3.x and 4.x before r4693 does not properly handle \ (backslash) characters, which allows remote authenticated users to execute arbitrary CTCP commands via vectors involving \r and \40 sequences, a different vulnerability than CVE-2010-2451 and CVE-2010-2452.


definition_id: oval:org.debian:def:9321706664624075098720659057199627023
title: CVE-2010-2787 mediawiki
description:
api.php in MediaWiki before 1.15.5 does not prevent use of public caching headers for private data, which allows remote attackers to bypass intended access restrictions and obtain sensitive information by retrieving documents from an HTTP proxy cache that has been used by a victim.


definition_id: oval:org.debian:def:63221264299052333436282467115873776590
title: CVE-2010-2788 mediawiki
description:
Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.


definition_id: oval:org.debian:def:122319150842969875997190038329888476764
title: CVE-2010-2790 zabbix
description:
Multiple cross-site scripting (XSS) vulnerabilities in the formatQuery function in frontends/php/include/classes/class.curl.php in Zabbix before 1.8.3rc1 allow remote attackers to inject arbitrary web script or HTML via the (1) filter_set, (2) show_details, (3) filter_rst, or (4) txt_select parameters to the triggers page (tr_status.php).  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:211340411342751231957123546582494081429
title: CVE-2010-2791 apache2
description:
mod_proxy in httpd in Apache HTTP Server 2.2.9, when running on Unix, does not close the backend connection if a timeout occurs when reading a response from a persistent connection, which allows remote attackers to obtain a potentially sensitive response intended for a different client in opportunistic circumstances via a normal HTTP request.  NOTE: this is the same issue as CVE-2010-2068, but for a different OS and set of affected versions.


definition_id: oval:org.debian:def:310047340746801286478681232971271258050
title: CVE-2010-2799 socat
description:
Stack-based buffer overflow in the nestlex function in nestlex.c in Socat 1.5.0.0 through 1.7.1.2 and 2.0.0-b1 through 2.0.0-b3, when bidirectional data relay is enabled, allows context-dependent attackers to execute arbitrary code via long command-line arguments.


definition_id: oval:org.debian:def:221771439537930007438994355660696528430
title: CVE-2010-2800 cabextract
description:
The MS-ZIP decompressor in cabextract before 1.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed MSZIP archive in a .cab file during a (1) test or (2) extract action, related to the libmspack library.


definition_id: oval:org.debian:def:227509981044848669124709592579883241418
title: CVE-2010-2801 cabextract
description:
Integer signedness error in the Quantum decompressor in cabextract before 1.3, when archive test mode is used, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Quantum archive in a .cab file, related to the libmspack library.


definition_id: oval:org.debian:def:176852878292220012741037910934026504820
title: CVE-2010-2805 freetype
description:
The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:88204501711198398276070080726048641809
title: CVE-2010-2806 freetype
description:
CVE-2010-2806 FreeType: Heap-based buffer overflow by processing FontType42 fonts with negative length of SFNT strings (FT bug #30656)


definition_id: oval:org.debian:def:42892853783621904355475704056045545837
title: CVE-2010-2807 freetype
description:
FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:120900448613286355538998569122012243950
title: CVE-2010-2812 znc
description:
Client.cpp in ZNC 0.092 allows remote attackers to cause a denial of service (exception and daemon crash) via a PING command that lacks an argument.


definition_id: oval:org.debian:def:81476516533697078353954220999785176230
title: CVE-2010-2891 libsmi
description:
Buffer overflow in the smiGetNode function in lib/smi.c in libsmi 0.4.8 allows context-dependent attackers to execute arbitrary code via an Object Identifier (aka OID) represented as a numerical string containing many components separated by . (dot) characters.


definition_id: oval:org.debian:def:151312463061574759058877699390654540095
title: CVE-2010-2934 znc
description:
Multiple unspecified vulnerabilities in ZNC 0.092 allow remote attackers to cause a denial of service (exception and daemon crash) via unknown vectors related to "unsafe substr() calls."


definition_id: oval:org.debian:def:118875817717155261409702525082195648058
title: CVE-2010-2937 vlc
description:
The ReadMetaFromId3v2 function in taglib.cpp in the TagLib plugin in VideoLAN VLC media player 0.9.0 through 1.1.2 does not properly process ID3v2 tags, which allows remote attackers to cause a denial of service (application crash) via a crafted media file.


definition_id: oval:org.debian:def:190412978529886362080676555292908975811
title: CVE-2010-2938 xen
description:
arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when an Intel platform without Extended Page Tables (EPT) functionality is used, accesses VMCS fields without verifying hardware support for these fields, which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.


definition_id: oval:org.debian:def:139994982403134525846470750200954665524
title: CVE-2010-2939 openssl
description:
Double free vulnerability in the ssl3_get_key_exchange function in the OpenSSL client (ssl/s3_clnt.c) in OpenSSL 1.0.0a, 0.9.8, 0.9.7, and possibly other versions, when using ECDH, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted private key with an invalid prime.  NOTE: some sources refer to this as a use-after-free issue.


definition_id: oval:org.debian:def:273517516416960500675913804921708693797
title: CVE-2010-2940 sssd
description:
The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.


definition_id: oval:org.debian:def:289032736290266017121490939451692451238
title: CVE-2010-2941 cups
description:
ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted IPP request.


definition_id: oval:org.debian:def:90300463886697670688586336367415278023
title: CVE-2010-2945 slim
description:
The default configuration of SLiM before 1.3.2 places ./ (dot slash) at the beginning of the default_path option, which might allow local users to gain privileges via a Trojan horse program in the current working directory, related to slim.conf and cfg.cpp.


definition_id: oval:org.debian:def:208961600184149968096362804543556081104
title: CVE-2010-2947 libhx
description:
Heap-based buffer overflow in the HX_split function in string.c in libHX before 3.6 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a string that is inconsistent with the expected number of fields.


definition_id: oval:org.debian:def:224365738264642702593221159359503916828
title: CVE-2010-2949 quagga
description:
bgpd in Quagga before 0.99.17 does not properly parse AS paths, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unknown AS type in an AS path attribute in a BGP UPDATE message.


definition_id: oval:org.debian:def:93552211437061692257521715859668427477
title: CVE-2010-2956 sudo
description:
Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.


definition_id: oval:org.debian:def:311939642741288654379145287274189151395
title: CVE-2010-2969 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.7.3 and earlier, and 1.9.x before 1.9.3, allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/LikePages.py, (2) action/chart.py, and (3) action/userprofile.py, a similar issue to CVE-2010-2487.


definition_id: oval:org.debian:def:162650433477956180002052984600057466796
title: CVE-2010-2970 moin
description:
Multiple cross-site scripting (XSS) vulnerabilities in MoinMoin 1.9.x before 1.9.3 allow remote attackers to inject arbitrary web script or HTML via crafted content, related to (1) action/SlideShow.py, (2) action/anywikidraw.py, and (3) action/language_setup.py, a similar issue to CVE-2010-2487.


definition_id: oval:org.debian:def:316414284759447040164353727344556852217
title: CVE-2010-2971 libmikmod
description:
loaders/load_it.c in libmikmod, possibly 3.1.12, does not properly account for the larger size of name##env relative to name##tick and name##node, which allows remote attackers to trigger a buffer over-read and possibly have unspecified other impact via a crafted Impulse Tracker file, a related issue to CVE-2010-2546.  NOTE: this issue exists because of an incomplete fix for CVE-2009-3995.


definition_id: oval:org.debian:def:326690904636041421622233418987443895214
title: CVE-2010-2992 wireshark
description:
packet-gsm_a_rr.c in the GSM A RR dissector in Wireshark 1.2.2 through 1.2.9 allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference.


definition_id: oval:org.debian:def:48315173834668369879317662191076507247
title: CVE-2010-2993 wireshark
description:
The IPMI dissector in Wireshark 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (infinite loop) via unknown vectors.


definition_id: oval:org.debian:def:306894665485926762635440774785315634658
title: CVE-2010-2994 wireshark
description:
Stack-based buffer overflow in the ASN.1 BER dissector in Wireshark 0.10.13 through 1.0.14 and 1.2.0 through 1.2.9 has unknown impact and remote attack vectors.  NOTE: this issue exists because of a CVE-2010-2284 regression.


definition_id: oval:org.debian:def:300786140402382864585233555702470170215
title: CVE-2010-2995 wireshark
description:
The SigComp Universal Decompressor Virtual Machine (UDVM) in Wireshark 0.10.8 through 1.0.14 and 1.2.0 through 1.2.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to sigcomp-udvm.c and an off-by-one error, which triggers a buffer overflow, different vulnerabilities than CVE-2010-2287.


definition_id: oval:org.debian:def:300121774272372559169769268150352406597
title: CVE-2010-3053 freetype
description:
bdf/bdflib.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) via a crafted BDF font file, related to an attempted modification of a value in a static string.


definition_id: oval:org.debian:def:479826367862538141235302108170149128
title: CVE-2010-3054 freetype
description:
Unspecified vulnerability in FreeType 2.3.9, and other versions before 2.4.2, allows remote attackers to cause a denial of service via vectors involving nested Standard Encoding Accented Character (aka seac) calls, related to psaux.h, cffgload.c, cffgload.h, and t1decode.c.


definition_id: oval:org.debian:def:322972187159861892886919881182182383529
title: CVE-2010-3071 bip
description:
bip before 0.8.6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an empty USER command.


definition_id: oval:org.debian:def:59095281957254488953566550755116046794
title: CVE-2010-3073 encfs
description:
SSL_Cipher.cpp in EncFS before 1.7.0 does not properly handle integer data sizes when constructing headers intended for randomization of initialization vectors, which makes it easier for local users to obtain sensitive information by defeating cryptographic protection mechanisms.


definition_id: oval:org.debian:def:24290840367057844821484928221349947699
title: CVE-2010-3074 encfs
description:
SSL_Cipher.cpp in EncFS before 1.7.0 uses an improper combination of an AES cipher and a CBC cipher mode for encrypted filesystems, which allows local users to obtain sensitive information via a watermark attack.


definition_id: oval:org.debian:def:234892328828379130540209514859564061317
title: CVE-2010-3075 encfs
description:
EncFS before 1.7.0 encrypts multiple blocks by means of the CFB cipher mode with the same initialization vector, which makes it easier for local users to obtain sensitive information via calculations involving recovery of XORed data, as demonstrated by an attack on encrypted data in which the last block contains only one byte.


definition_id: oval:org.debian:def:199874663587213053751525295747180769976
title: CVE-2010-3082 python-django
description:
Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.


definition_id: oval:org.debian:def:277092988836524327935109042777741276098
title: CVE-2010-3085 mednafen
description:
The network-play implementation in Mednafen before 0.8.D might allow remote servers to execute arbitrary code via unspecified vectors, related to "stack manipulation" issues.


definition_id: oval:org.debian:def:25196448885956170492777340449786889509
title: CVE-2010-3087 tiff
description:
LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted TIFF image.


definition_id: oval:org.debian:def:308527925076020946846753562858374914383
title: CVE-2010-3170 kde4libs
description:
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:77871490727987337708685282310911979083
title: CVE-2010-3173 nss
description:
The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly set the minimum key length for Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.


definition_id: oval:org.debian:def:2072523174297951178309483911620881439
title: CVE-2010-3275 vlc
description:
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."


definition_id: oval:org.debian:def:47294847185033131838994528608394209270
title: CVE-2010-3276 vlc
description:
libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.


definition_id: oval:org.debian:def:259591035825448116715561364195486104163
title: CVE-2010-3304 dovecot
description:
The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs.


definition_id: oval:org.debian:def:315239942204569585268427423605924086880
title: CVE-2010-3306 weborf
description:
Directory traversal vulnerability in the modURL function in instance.c in Weborf before 0.12.3 allows remote attackers to read arbitrary files via ..%2f sequences in a URI.


definition_id: oval:org.debian:def:295574479573202676787799825908045938832
title: CVE-2010-3311 freetype
description:
CVE-2010-3311 freetype: Input stream position error by processing Compact Font Format (CFF) font files


definition_id: oval:org.debian:def:234997237868364569350842888032569660187
title: CVE-2010-3312 epiphany-browser
description:
Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificate.


definition_id: oval:org.debian:def:134225270210612788176926153927734613797
title: CVE-2010-3315 subversion
description:
authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.


definition_id: oval:org.debian:def:104857570780832768682815455953440614665
title: CVE-2010-3316 pam
description:
The run_coprocess function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) before 1.1.2 does not check the return values of the setuid, setgid, and setgroups system calls, which might allow local users to read arbitrary files by executing a program that relies on the pam_xauth PAM check.


definition_id: oval:org.debian:def:145011797099655503101026661174393598449
title: CVE-2010-3349 ardour
description:
Ardour 2.8.11 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:227459089075619539393746482600343147186
title: CVE-2010-3351 bristol
description:
startBristol in Bristol 0.60.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:71066357215118224090059716063820912020
title: CVE-2010-3357 gnome-subtitles
description:
gnome-subtitles 1.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:255002191073162126186251333905756700742
title: CVE-2010-3359 gargoyle-free
description:
If LD_LIBRARY_PATH is undefined in gargoyle-free before 2009-08-25, the variable will point to the current directory. This can allow a local user to trick another user into running gargoyle in a directory with a cracked libgarglk.so and gain access to the user's account.


definition_id: oval:org.debian:def:77005187462794125815326168402539871259
title: CVE-2010-3363 roaraudio
description:
roarify in roaraudio 0.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:126596389551155856715045617393735237349
title: CVE-2010-3364 vips
description:
The vips-7.22 script in VIPS 7.22.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:201093897199388482419032453852378397752
title: CVE-2010-3374 qtcreator
description:
Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:140337967156769932351359142484243973962
title: CVE-2010-3378 scilab
description:
The (1) scilab, (2) scilab-cli, and (3) scilab-adv-cli scripts in Scilab 5.2.2 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:234664846377088052660458882259436332914
title: CVE-2010-3380 slurm-llnl
description:
The (1) init.d/slurm and (2) init.d/slurmdbd scripts in SLURM before 2.1.14 place the . (dot) directory in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:89670317818118084361858737159997041303
title: CVE-2010-3381 tangerine
description:
The (1) tangerine and (2) tangerine-properties scripts in Tangerine 0.3.2.2 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:244596965124686594414967516324885332570
title: CVE-2010-3384 torcs
description:
The (1) torcs, (2) nfsperf, (3) accc, (4) texmapper, (5) trackgen, and (6) nfs2ac scripts in TORCS 1.3.1 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:212649580704330390014527933366166268168
title: CVE-2010-3385 tuxguitar
description:
TuxGuitar 1.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:152681718547914288869359961285958751766
title: CVE-2010-3386 ust
description:
usttrace in LTTng Userspace Tracer (aka UST) 0.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:66726240575984237869789915315033713038
title: CVE-2010-3387 vdr
description:
** DISPUTED **  vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.  NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended.


definition_id: oval:org.debian:def:267541926045320122137727854028423402383
title: CVE-2010-3393 magics++
description:
magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:157784072356934500382114016648215401734
title: CVE-2010-3429 ffmpeg
description:
flicvideo.c in libavcodec 0.6 and earlier in FFmpeg, as used in MPlayer and other products, allows remote attackers to execute arbitrary code via a crafted flic file, related to an "arbitrary offset dereference vulnerability."


definition_id: oval:org.debian:def:186227359365746194047017086009218548468
title: CVE-2010-3430 pam
description:
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not perform the required setfsgid and setgroups system calls, which might allow local users to obtain sensitive information by leveraging unintended group permissions, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.


definition_id: oval:org.debian:def:66139610872982863145043552320756190153
title: CVE-2010-3431 pam
description:
The privilege-dropping implementation in the (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) 1.1.2 does not check the return value of the setfsuid system call, which might allow local users to obtain sensitive information by leveraging an unintended uid, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-3435.


definition_id: oval:org.debian:def:144943055415536790545232867381515525084
title: CVE-2010-3434 clamav
description:
Buffer overflow in the find_stream_bounds function in pdf.c in libclamav in ClamAV before 0.96.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:174913100362889721463922684650424547539
title: CVE-2010-3435 pam
description:
The (1) pam_env and (2) pam_mail modules in Linux-PAM (aka pam) before 1.1.2 use root privileges during read access to files and directories that belong to arbitrary user accounts, which might allow local users to obtain sensitive information by leveraging this filesystem activity, as demonstrated by a symlink attack on the .pam_environment file in a user's home directory.


definition_id: oval:org.debian:def:149117049715744349622781214970330698247
title: CVE-2010-3438 libpoe-component-irc-perl
description:
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.


definition_id: oval:org.debian:def:314741697472111364173857430361130081611
title: CVE-2010-3439 alien-arena
description:
It is possible to cause a DoS condition by causing the server to crash in alien-arena 7.33 by supplying various invalid parameters to the download command.


definition_id: oval:org.debian:def:177980447888532148139057475261949851508
title: CVE-2010-3440 babiloo
description:
babiloo 2.0.9 before 2.0.11 creates temporary files with predictable names when downloading and unpacking dictionary files, allowing a local attacker to overwrite arbitrary files.


definition_id: oval:org.debian:def:87247112196011085909004382771495169648
title: CVE-2010-3441 abcm2ps
description:
Multiple buffer overflows in abcm2ps before 5.9.12 might allow remote attackers to execute arbitrary code via (1) a crafted input file, related to the PUT0 and PUT1 output macros; (2) a crafted input file, related to the trim_title function; and possibly (3) a long -O option on a command line.


definition_id: oval:org.debian:def:4621739677468016614184780566713324449
title: CVE-2010-3443 quassel
description:
ctcphandler.cpp in Quassel before 0.6.3 and 0.7.x before 0.7.1 allows remote attackers to cause a denial of service (unresponsive IRC) via multiple Client-To-Client Protocol (CTCP) requests in a PRIVMSG message.


definition_id: oval:org.debian:def:302937745865768477732289515108715732184
title: CVE-2010-3444 pyfribidi
description:
Buffer overflow in the log2vis_utf8 function in pyfribidi.c in GNU FriBidi 0.19.1, 0.19.2, and possibly other versions, as used in PyFriBidi 0.10.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Arabic UTF-8 string that causes original 2-byte UTF-8 sequences to be transformed into 3-byte sequences.


definition_id: oval:org.debian:def:217412488071346127102124327865796431714
title: CVE-2010-3445 wireshark
description:
Stack consumption vulnerability in the dissect_ber_unknown function in epan/dissectors/packet-ber.c in the BER dissector in Wireshark 1.4.x before 1.4.1 and 1.2.x before 1.2.12 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a long string in an unknown ASN.1/BER encoded packet, as demonstrated using SNMP.


definition_id: oval:org.debian:def:243859108543366123057376890877542006964
title: CVE-2010-3476 otrs2
description:
Open Ticket Request System (OTRS) 2.3.x before 2.3.6 and 2.4.x before 2.4.8 does not properly handle the matching of Perl regular expressions against HTML e-mail messages, which allows remote attackers to cause a denial of service (CPU consumption) via a large message, a different vulnerability than CVE-2010-2080.


definition_id: oval:org.debian:def:252915891506212748425386760854154717222
title: CVE-2010-3484 mapserver
description:
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the handle parameter to LightNEasy.php, a different vector than CVE-2008-6593.


definition_id: oval:org.debian:def:89487740700786115722510218238210839679
title: CVE-2010-3485 mapserver
description:
SQL injection vulnerability in common.php in LightNEasy 3.2.1 allows remote attackers to execute arbitrary SQL commands via the userhandle cookie to LightNEasy.php, a different vector than CVE-2008-6593.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


definition_id: oval:org.debian:def:300341523658098751726138193000755266338
title: CVE-2010-3492 python2.7
description:
The asyncore module in Python before 3.2 does not properly handle unsuccessful calls to the accept function, and does not have accompanying documentation describing how daemon applications should handle unsuccessful calls to the accept function, which makes it easier for remote attackers to conduct denial of service attacks that terminate these applications via network connections.


definition_id: oval:org.debian:def:110419299769420311245486947005721443533
title: CVE-2010-3494 python-pyftpdlib
description:
Race condition in the FTPHandler class in ftpserver.py in pyftpdlib before 0.5.2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.


definition_id: oval:org.debian:def:277674365925438092299265338917618284012
title: CVE-2010-3495 zodb
description:
Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.


definition_id: oval:org.debian:def:133242014455457977263877520810810037539
title: CVE-2010-3611 isc-dhcp
description:
ISC DHCP server 4.0 before 4.0.2, 4.1 before 4.1.2, and 4.2 before 4.2.0-P1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a DHCPv6 packet containing a Relay-Forward message without an address in the Relay-Forward link-address field.


definition_id: oval:org.debian:def:3601609326907175390945301896301445928
title: CVE-2010-3613 bind9
description:
named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.


definition_id: oval:org.debian:def:177220492477189692826607537953922305354
title: CVE-2010-3614 bind9
description:
named in ISC BIND 9.x before 9.6.2-P3, 9.7.x before 9.7.2-P3, 9.4-ESV before 9.4-ESV-R4, and 9.6-ESV before 9.6-ESV-R3 does not properly determine the security status of an NS RRset during a DNSKEY algorithm rollover, which might allow remote attackers to cause a denial of service (DNSSEC validation error) by triggering a rollover.


definition_id: oval:org.debian:def:31563545500283042693723114259227882853
title: CVE-2010-3615 bind9
description:
named in ISC BIND 9.7.2-P2 does not check all intended locations for allow-query ACLs, which might allow remote attackers to make successful requests for private DNS records via the standard DNS query mechanism.


definition_id: oval:org.debian:def:157070339885852909868658955710847279077
title: CVE-2010-3696 freeradius
description:
The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in certain non-default builds, does not properly handle the DHCP Relay Agent Information option, which allows remote attackers to cause a denial of service (infinite loop and daemon outage) via a packet that has more than one sub-option.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:298734958220454822680409420922227272770
title: CVE-2010-3697 freeradius
description:
The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x before 2.1.10, in certain circumstances involving long-term database outages, does not properly handle long queue times for requests, which allows remote attackers to cause a denial of service (daemon crash) by sending many requests.


definition_id: oval:org.debian:def:216080166983966273983693777937160569450
title: CVE-2010-3702 poppler
description:
The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.


definition_id: oval:org.debian:def:127610204639450439166195330199203240298
title: CVE-2010-3703 poppler
description:
The PostScriptFunction::PostScriptFunction function in poppler/Function.cc in the PDF parser in poppler 0.8.7 and possibly other versions up to 0.15.1, and possibly other products, allows context-dependent attackers to cause a denial of service (crash) via a PDF file that triggers an uninitialized pointer dereference.


definition_id: oval:org.debian:def:125664757444186201910394423041708667099
title: CVE-2010-3704 poppler
description:
The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a PDF file with a crafted PostScript Type1 font that contains a negative array index, which bypasses input validation and triggers memory corruption.


definition_id: oval:org.debian:def:39129600851045061277698437211844726615
title: CVE-2010-3706 dovecot
description:
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.


definition_id: oval:org.debian:def:218198989163208671090970373732435948767
title: CVE-2010-3707 dovecot
description:
plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox.


definition_id: oval:org.debian:def:288352183949443082808257972049310082506
title: CVE-2010-3711 pidgin
description:
libpurple in Pidgin before 2.7.4 does not properly validate the return value of the purple_base64_decode function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a crafted message, related to the plugins for MSN, MySpaceIM, XMPP, and Yahoo! and the NTLM authentication support.


definition_id: oval:org.debian:def:219859419198771134050518114847048385709
title: CVE-2010-3762 bind9
description:
ISC BIND before 9.7.2-P2, when DNSSEC validation is enabled, does not properly handle certain bad signatures if multiple trust anchors exist for a single zone, which allows remote attackers to cause a denial of service (daemon crash) via a DNS query.


definition_id: oval:org.debian:def:142760508392845963661009313485955616083
title: CVE-2010-3779 dovecot
description:
Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.


definition_id: oval:org.debian:def:225963518988803604818232869980640854844
title: CVE-2010-3780 dovecot
description:
Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions.


definition_id: oval:org.debian:def:30746896323583610274053454058186034694
title: CVE-2010-3814 freetype
description:
Heap-based buffer overflow in the Ins_SHZ function in ttinterp.c in FreeType 2.4.3 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted SHZ bytecode instruction, related to TrueType opcodes, as demonstrated by a PDF document with a crafted embedded font.


definition_id: oval:org.debian:def:231493912934800949156295929124261545544
title: CVE-2010-3843 ettercap
description:
The GTK version of ettercap uses a global settings file at /tmp/.ettercap_gtk and does not verify ownership of this file. When parsing this file for settings in gtkui_conf_read() (src/interfacesgtk/ec_gtk_conf.c), an unchecked sscanf() call allows a maliciously placed settings file to overflow a statically-sized buffer on the stack.


definition_id: oval:org.debian:def:194162310658053168501726960249811047425
title: CVE-2010-3844 ettercap
description:
An unchecked sscanf() call in ettercap before 0.7.5 allows an insecure temporary settings file to overflow a static-sized buffer on the stack.


definition_id: oval:org.debian:def:117990370503169459814395164887459532787
title: CVE-2010-3845 libapache-authenhook-perl
description:
libapache-authenhook-perl 2.00-04 stores usernames and passwords in plaintext in the vhost error log.


definition_id: oval:org.debian:def:49467453706892200721378089768167773891
title: CVE-2010-3853 pam
description:
pam_namespace.c in the pam_namespace module in Linux-PAM (aka pam) before 1.1.3 uses the environment of the invoking application or service during execution of the namespace.init script, which might allow local users to gain privileges by running a setuid program that relies on the pam_namespace PAM check, as demonstrated by the sudo program.


definition_id: oval:org.debian:def:243721348648524995408369895019949851500
title: CVE-2010-3867 proftpd-dfsg
description:
Multiple directory traversal vulnerabilities in the mod_site_misc module in ProFTPD before 1.3.3c allow remote authenticated users to create directories, delete directories, create symlinks, and modify file timestamps via directory traversal sequences in a (1) SITE MKDIR, (2) SITE RMDIR, (3) SITE SYMLINK, or (4) SITE UTIME command.


definition_id: oval:org.debian:def:114349535168365691437949458432838964396
title: CVE-2010-3872 libapache2-mod-fcgid
description:
The fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.6 for the Apache HTTP Server does not use bytewise pointer arithmetic in certain circumstances, which has unspecified impact and attack vectors related to "untrusted FastCGI applications" and a "stack buffer overwrite."


definition_id: oval:org.debian:def:282378350645338615745264117943740239014
title: CVE-2010-3879 fuse
description:
FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.


definition_id: oval:org.debian:def:315341860991057066634839554272108733560
title: CVE-2010-3900 midori
description:
Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.


definition_id: oval:org.debian:def:340203106594391550257147320858883659345
title: CVE-2010-3901 openconnect
description:
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.


definition_id: oval:org.debian:def:192397968939911236800635176177153288304
title: CVE-2010-3902 openconnect
description:
OpenConnect before 2.26 places the webvpn cookie value in the debugging output, which might allow remote attackers to obtain sensitive information by reading this output, as demonstrated by output posted to the public openconnect-devel mailing list.


definition_id: oval:org.debian:def:59537610958114237720246962710084987224
title: CVE-2010-3903 openconnect
description:
Unspecified vulnerability in OpenConnect before 2.23 allows remote AnyConnect SSL VPN servers to cause a denial of service (application crash) via a 404 HTTP status code.


definition_id: oval:org.debian:def:329237928483403140556707672949084327049
title: CVE-2010-3906 git
description:
Cross-site scripting (XSS) vulnerability in Gitweb 1.7.3.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the (1) f and (2) fp parameters.


definition_id: oval:org.debian:def:134795734589655409656968186405231592299
title: CVE-2010-3907 vlc
description:
Multiple integer overflows in real.c in the Real demuxer plugin in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a zero i_subpackets value in a Real Media file, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:221476831650139073957220873359219257798
title: CVE-2010-3908 ffmpeg
description:
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a malformed WMV file.


definition_id: oval:org.debian:def:86867974404507365367934451239580322771
title: CVE-2010-3999 gnucash
description:
gnc-test-env in GnuCash 2.3.15 and earlier places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:291116721104467673061692400772456630205
title: CVE-2010-4000 gnome-shell
description:
gnome-shell in GNOME Shell 2.31.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:18207289183228773551004953475851874242
title: CVE-2010-4008 libxml2
description:
libxml2 before 2.7.8, as used in Google Chrome before 7.0.517.44, Apple Safari 5.0.2 and earlier, and other products, reads from invalid memory locations during processing of malformed XPath expressions, which allows context-dependent attackers to cause a denial of service (application crash) via a crafted XML document.


definition_id: oval:org.debian:def:218335184233684873996418040693561881560
title: CVE-2010-4020 krb5
description:
MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.


definition_id: oval:org.debian:def:339585176526185496689275032544437870641
title: CVE-2010-4021 krb5
description:
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 does not properly restrict the use of TGT credentials for armoring TGS requests, which might allow remote authenticated users to impersonate a client by rewriting an inner request, aka a "KrbFastReq forgery issue."


definition_id: oval:org.debian:def:82447153780372655324288769966561894670
title: CVE-2010-4022 krb5
description:
The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1.7, 1.8, and 1.9, when running in standalone mode, does not properly handle when a worker child process "exits abnormally," which allows remote attackers to cause a denial of service (listening process termination, no new connections, and lack of updates in slave KVC) via unspecified vectors.


definition_id: oval:org.debian:def:217495177196841113100192199451626929197
title: CVE-2010-4051 glibc
description:
The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a "RE_DUP_MAX overflow."


definition_id: oval:org.debian:def:256106261034610322671323670816253251048
title: CVE-2010-4052 glibc
description:
Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.


definition_id: oval:org.debian:def:334933058937728287711329001724293401986
title: CVE-2010-4054 ghostscript
description:
The gs_type2_interpret function in Ghostscript allows remote attackers to cause a denial of service (incorrect pointer dereference and application crash) via crafted font data in a compressed data stream, aka bug 691043.


definition_id: oval:org.debian:def:67216760264499528915724919760609371597
title: CVE-2010-4071 otrs2
description:
Cross-site scripting (XSS) vulnerability in AgentTicketZoom in OTRS 2.4.x before 2.4.9, when RichText is enabled, allows remote attackers to inject arbitrary web script or HTML via JavaScript in an HTML e-mail.


definition_id: oval:org.debian:def:76500997750367601837259656152674047974
title: CVE-2010-4096 monkeysphere
description:
share/ma/keys_for_user in Monkeysphere 0.31 and 0.32 allows local users to execute arbitrary code via unknown manipulations related to the "monkeysphere-authentication keys-for-user" command.


definition_id: oval:org.debian:def:187791961433475240050695790766310379580
title: CVE-2010-4159 mono
description:
Untrusted search path vulnerability in metadata/loader.c in Mono 2.8 and earlier allows local users to gain privileges via a Trojan horse shared library in the current working directory.


definition_id: oval:org.debian:def:329322552068504121598662044986293035527
title: CVE-2010-4167 imagemagick
description:
Untrusted search path vulnerability in configure.c in ImageMagick before 6.6.5-5, when MAGICKCORE_INSTALLED_SUPPORT is defined, allows local users to gain privileges via a Trojan horse configuration file in the current working directory.


definition_id: oval:org.debian:def:134065751316192935406209169548593435531
title: CVE-2010-4168 openttd
description:
Multiple use-after-free vulnerabilities in OpenTTD 1.0.x before 1.0.5 allow (1) remote attackers to cause a denial of service (invalid write and daemon crash) by abruptly disconnecting during transmission of the map from the server, related to network/network_server.cpp; (2) remote attackers to cause a denial of service (invalid read and daemon crash) by abruptly disconnecting, related to network/network_server.cpp; and (3) remote servers to cause a denial of service (invalid read and application crash) by forcing a disconnection during the join process, related to network/network.cpp.


definition_id: oval:org.debian:def:12082643470641353977357342197423684933
title: CVE-2010-4171 systemtap
description:
The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap, which allows local users to cause a denial of service (unloading of arbitrary kernel modules).


definition_id: oval:org.debian:def:322385941644584487092682415234058511728
title: CVE-2010-4180 openssl
description:
OpenSSL before 0.9.8q, and 1.0.x before 1.0.0c, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier.


definition_id: oval:org.debian:def:13186828067356191591282729806105131633
title: CVE-2010-4183 php-htmlpurifier
description:
Multiple cross-site scripting (XSS) vulnerabilities in HTML Purifier before 4.1.0, when Internet Explorer is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) background-image, (2) background, or (3) font-family Cascading Style Sheets (CSS) property, a different vulnerability than CVE-2010-2479.


definition_id: oval:org.debian:def:26251525005448333999678398996285298498
title: CVE-2010-4203 libvpx
description:
WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via invalid frames.


definition_id: oval:org.debian:def:161668663895651347624735339787209070946
title: CVE-2010-4221 proftpd-dfsg
description:
Multiple stack-based buffer overflows in the pr_netio_telnet_gets function in netio.c in ProFTPD before 1.3.3c allow remote attackers to execute arbitrary code via vectors involving a TELNET IAC escape character to a (1) FTP or (2) FTPS server.


definition_id: oval:org.debian:def:208047907910495178557229519680073364949
title: CVE-2010-4225 mono
description:
Unspecified vulnerability in the mod_mono module for XSP in Mono 2.8.x before 2.8.2 allows remote attackers to obtain the source code for .aspx (ASP.NET) applications via unknown vectors related to an "unloading bug."


definition_id: oval:org.debian:def:64714199365918972320033689829540174532
title: CVE-2010-4237 mercurial
description:
Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a Certificate Authority to perform a man-in-the-middle attack.


definition_id: oval:org.debian:def:11885880945752697522489059931148980906
title: CVE-2010-4255 xen
description:
The fixup_page_fault function in arch/x86/traps.c in Xen 4.0.1 and earlier on 64-bit platforms, when paravirtualization is enabled, does not verify that kernel mode is used to call the handle_gdt_ldt_mapping_fault function, which allows guest OS users to cause a denial of service (host OS BUG_ON) via a crafted memory access.


definition_id: oval:org.debian:def:43405722193618738637784452267686720997
title: CVE-2010-4257 wordpress
description:
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.


definition_id: oval:org.debian:def:83904604994155937341599148915281189445
title: CVE-2010-4259 fontforge
description:
Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long CHARSET_REGISTRY header in a BDF font file.


definition_id: oval:org.debian:def:40947982286892213418441970240588320372
title: CVE-2010-4260 clamav
description:
Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka (1) "bb #2358" and (2) "bb #2396."


definition_id: oval:org.debian:def:273993153783403326053243983125902040853
title: CVE-2010-4261 clamav
description:
Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:256876187677830266086849435270321434023
title: CVE-2010-4262 xfig
description:
Stack-based buffer overflow in Xfig 3.2.4 and 3.2.5 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a FIG image with a crafted color definition.


definition_id: oval:org.debian:def:62505429541581579122012473426117890213
title: CVE-2010-4267 hplip
description:
Stack-based buffer overflow in the hpmud_get_pml function in io/hpmud/pml.c in Hewlett-Packard Linux Imaging and Printing (HPLIP) 1.6.7, 3.9.8, 3.10.9, and probably other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SNMP response with a large length value.


definition_id: oval:org.debian:def:81354167006025977110589743892252186685
title: CVE-2010-4300 wireshark
description:
Heap-based buffer overflow in the dissect_ldss_transfer function (epan/dissectors/packet-ldss.c) in the LDSS dissector in Wireshark 1.2.0 through 1.2.12 and 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an LDSS packet with a long digest line that triggers memory corruption.


definition_id: oval:org.debian:def:258793465407192639619035435734756506464
title: CVE-2010-4334 libio-socket-ssl-perl
description:
The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.


definition_id: oval:org.debian:def:68475968532132073745453856611237953112
title: CVE-2010-4335 cakephp
description:
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.


definition_id: oval:org.debian:def:19489844784589283164037888075897570325
title: CVE-2010-4336 collectd
description:
The cu_rrd_create_file function (src/utils_rrdcreate.c) in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service (assertion failure) via a packet with a timestamp whose value is 10 or less, as demonstrated by creating RRD files using the (1) RRDtool and (2) RRDCacheD plugins.


definition_id: oval:org.debian:def:322707943137113127003846395713923779322
title: CVE-2010-4338 ocrodjvu
description:
ocrodjvu 0.4.6-1 on Debian GNU/Linux allows local users to modify arbitrary files via a symlink attack on temporary files that are generated when Cuneiform is invoked as the OCR engine.


definition_id: oval:org.debian:def:133791963921515703276466512233906407963
title: CVE-2010-4340 libcloud
description:
libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle (MITM) attack.


definition_id: oval:org.debian:def:128284414423271885490930572503169072236
title: CVE-2010-4341 sssd
description:
The pam_parse_in_data_v2 function in src/responder/pam/pamsrv_cmd.c in the PAM responder in SSSD 1.5.0, 1.4.x, and 1.3 allows local users to cause a denial of service (infinite loop, crash, and login prevention) via a crafted packet.


definition_id: oval:org.debian:def:169006303674770889946094574501751628517
title: CVE-2010-4352 dbus
description:
Stack consumption vulnerability in D-Bus (aka DBus) before 1.4.1 allows local users to cause a denial of service (daemon crash) via a message containing many nested variants.


definition_id: oval:org.debian:def:215942505715142836282541526014504640767
title: CVE-2010-4367 awstats
description:
awstats.cgi in AWStats before 7.0 accepts a configdir parameter in the URL, which allows remote attackers to execute arbitrary commands via a crafted configuration file located on a (1) WebDAV server or (2) NFS server.


definition_id: oval:org.debian:def:338023174710813690076602953700511034438
title: CVE-2010-4369 awstats
description:
Directory traversal vulnerability in AWStats before 7.0 allows remote attackers to have an unspecified impact via a crafted LoadPlugin directory.


definition_id: oval:org.debian:def:86621004789980833250307613599983579707
title: CVE-2010-4410 libcgi-pm-perl
description:
CRLF injection vulnerability in the header function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via vectors related to non-whitespace characters preceded by newline characters, a different vulnerability than CVE-2010-2761 and CVE-2010-3172.


definition_id: oval:org.debian:def:296205359895706276363076542187928240432
title: CVE-2010-4411 libcgi-pm-perl
description:
Unspecified vulnerability in CGI.pm 3.50 and earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unknown vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2010-2761.


definition_id: oval:org.debian:def:255229247580764642874588908612778799519
title: CVE-2010-4479 clamav
description:
Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka "bb #2380," a different vulnerability than CVE-2010-4260.


definition_id: oval:org.debian:def:133066496003876923181854689199267783523
title: CVE-2010-4489 libvpx
description:
libvpx, as used in Google Chrome before 8.0.552.215 and possibly other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebM video.  NOTE: this vulnerability exists because of a regression.


definition_id: oval:org.debian:def:305344645965431448253197849023160278052
title: CVE-2010-4494 libxml2
description:
Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.


definition_id: oval:org.debian:def:259409360862123727942651288271665621833
title: CVE-2010-4523 opensc
description:
Multiple stack-based buffer overflows in libopensc in OpenSC 0.11.13 and earlier allow physically proximate attackers to execute arbitrary code via a long serial-number field on a smart card, related to (1) card-acos5.c, (2) card-atrust-acos.c, and (3) card-starcos.c.


definition_id: oval:org.debian:def:269787101199902557371293354519181874908
title: CVE-2010-4524 mhonarc
description:
Cross-site scripting (XSS) vulnerability in lib/mhtxthtml.pl in MHonArc 2.6.16 allows remote attackers to inject arbitrary web script or HTML via a malformed start tag and end tag for a SCRIPT element, as demonstrated by <scr<body>ipt> and </scr<body>ipt> sequences.


definition_id: oval:org.debian:def:245642395101910445179508765112398878655
title: CVE-2010-4528 pidgin
description:
directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.


definition_id: oval:org.debian:def:192421463925159491482541211673477430523
title: CVE-2010-4530 ccid
description:
CVE-2010-4530 CCID: Integer overflow, leading to array index error when processing crafted serial number of certain cards


definition_id: oval:org.debian:def:175476195389483141034134703805189510514
title: CVE-2010-4532 offlineimap
description:
offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks.


definition_id: oval:org.debian:def:21169542209746244691936857790271861840
title: CVE-2010-4533 offlineimap
description:
offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies.


definition_id: oval:org.debian:def:243779694645685344839271374562216753747
title: CVE-2010-4534 python-django
description:
The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.


definition_id: oval:org.debian:def:123709868890102618212880688408299094971
title: CVE-2010-4535 python-django
description:
The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.


definition_id: oval:org.debian:def:311531699053735010506329227536895082929
title: CVE-2010-4536 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the & (ampersand) character, (2) the case of an attribute name, (3) a padded entity, and (4) an entity that is not in normalized form.


definition_id: oval:org.debian:def:47005980070547324601734858344017438660
title: CVE-2010-4538 wireshark
description:
Buffer overflow in the sect_enttec_dmx_da function in epan/dissectors/packet-enttec.c in Wireshark 1.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ENTTEC DMX packet with Run Length Encoding (RLE) compression.


definition_id: oval:org.debian:def:256651494435392446489710106718731494686
title: CVE-2010-4539 subversion
description:
The walk function in repos.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.15, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger the walking of SVNParentPath collections.


definition_id: oval:org.debian:def:247290134201861319917250529599297527386
title: CVE-2010-4644 subversion
description:
Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 allow remote authenticated users to cause a denial of service (memory consumption and daemon crash) via the -g option to the blame command.


definition_id: oval:org.debian:def:285011994722326818718056399312732862419
title: CVE-2010-4652 proftpd-dfsg
description:
Heap-based buffer overflow in the sql_prepare_where function (contrib/mod_sql.c) in ProFTPD before 1.3.3d, when mod_sql is enabled, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted username containing substitution tags, which are not properly handled during construction of an SQL query.


definition_id: oval:org.debian:def:255905825228320658440611876084797031489
title: CVE-2010-4666 libarchive
description:
Buffer overflow in libarchive 3.0 pre-release code allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted CAB file, which is not properly handled during the reading of Huffman code data within LZX compressed data.


definition_id: oval:org.debian:def:254200256859364166831741053022586831389
title: CVE-2010-4704 ffmpeg
description:
libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and earlier allows remote attackers to cause a denial of service (application crash) via a crafted .ogg file, related to the vorbis_floor0_decode function.  NOTE: this might overlap CVE-2011-0480.


definition_id: oval:org.debian:def:69383892112075492409913020059178848102
title: CVE-2010-4706 pam
description:
The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target uid, which might allow local users to delete unintended files by executing a program that relies on the pam_xauth PAM check.


definition_id: oval:org.debian:def:155639657365533825860188377257714528961
title: CVE-2010-4707 pam
description:
The check_acl function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not verify that a certain ACL file is a regular file, which might allow local users to cause a denial of service (resource consumption) via a special file.


definition_id: oval:org.debian:def:63170818056834795308396854924776510714
title: CVE-2010-4708 pam
description:
The pam_env module in Linux-PAM (aka pam) 1.1.2 and earlier reads the .pam_environment file in a user's home directory, which might allow local users to run programs with an unintended environment by executing a program that relies on the pam_env PAM check.


definition_id: oval:org.debian:def:278494413395997883431681177860104184041
title: CVE-2010-4722 smarty3
description:
Unspecified vulnerability in the fetch plugin in Smarty before 3.0.2 has unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:33383367858961685418657500994043700636
title: CVE-2010-4723 smarty3
description:
Smarty before 3.0.0, when security is enabled, does not prevent access to the (1) dynamic and (2) private object members of an assigned object, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:331343784247916622477972402812611572616
title: CVE-2010-4724 smarty3
description:
Multiple unspecified vulnerabilities in the parser implementation in Smarty before 3.0.0 RC3 have unknown impact and remote attack vectors.


definition_id: oval:org.debian:def:304960298434381420504158543421253674413
title: CVE-2010-4725 smarty3
description:
Smarty before 3.0.0 RC3 does not properly handle an on value of the asp_tags option in the php.ini file, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:117101211553813292628297179706883879112
title: CVE-2010-4726 smarty3
description:
Unspecified vulnerability in the math plugin in Smarty before 3.0.0 RC1 has unknown impact and remote attack vectors.  NOTE: this might overlap CVE-2009-1669.


definition_id: oval:org.debian:def:182743823350314343519199728930801280135
title: CVE-2010-4727 smarty3
description:
Smarty before 3.0.0 beta 7 does not properly handle the <?php and ?> tags, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:325952231398388824365008357304664135409
title: CVE-2010-4743 abcm2ps
description:
Heap-based buffer overflow in the getarena function in abc2ps.c in abcm2ps before 5.9.13 might allow remote attackers to execute arbitrary code via a crafted ABC file, a different vulnerability than CVE-2010-3441.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:265338718607491792925611477562024588681
title: CVE-2010-4744 abcm2ps
description:
Multiple unspecified vulnerabilities in abcm2ps before 5.9.13 have unknown impact and attack vectors, a different issue than CVE-2010-3441.


definition_id: oval:org.debian:def:229675214028087205365272462062299477169
title: CVE-2010-4758 otrs2
description:
installer.pl in Open Ticket Request System (OTRS) before 3.0.3 has an Inbound Mail Password field that uses the text type, instead of the password type, for its INPUT element, which makes it easier for physically proximate attackers to obtain the password by reading the workstation screen.


definition_id: oval:org.debian:def:194087956764811437254254392873583604895
title: CVE-2010-4759 otrs2
description:
Open Ticket Request System (OTRS) before 3.0.0-beta7 does not properly restrict the ticket ages that are within the scope of a search, which allows remote authenticated users to cause a denial of service (daemon hang) via a fulltext search.


definition_id: oval:org.debian:def:170808598900737279881475642338951564643
title: CVE-2010-4760 otrs2
description:
Open Ticket Request System (OTRS) before 3.0.0-beta6 adds email-notification-ext articles to tickets during processing of event-based notifications, which allows remote authenticated users to obtain potentially sensitive information by reading a ticket.


definition_id: oval:org.debian:def:23043387942992346579445687670676106485
title: CVE-2010-4761 otrs2
description:
The customer-interface ticket-print dialog in Open Ticket Request System (OTRS) before 3.0.0-beta3 does not properly restrict customer-visible data, which allows remote authenticated users to obtain potentially sensitive information from the (1) responsible, (2) owner, (3) accounted time, (4) pending until, and (5) lock fields by reading this dialog.


definition_id: oval:org.debian:def:306853713720080363496681842585857927359
title: CVE-2010-4762 otrs2
description:
Cross-site scripting (XSS) vulnerability in the rich-text-editor component in Open Ticket Request System (OTRS) before 3.0.0-beta2 allows remote authenticated users to inject arbitrary web script or HTML by using the "source code" feature in the customer interface.


definition_id: oval:org.debian:def:15987169187903551660852655127423258624
title: CVE-2010-4763 otrs2
description:
The ACL-customer-status Ticket Type setting in Open Ticket Request System (OTRS) before 3.0.0-beta1 does not restrict the ticket options after an AJAX reload, which allows remote authenticated users to bypass intended ACL restrictions on the (1) Status, (2) Service, and (3) Queue via selections.


definition_id: oval:org.debian:def:167756078250598864766688586792288193717
title: CVE-2010-4764 otrs2
description:
Open Ticket Request System (OTRS) before 2.4.10, and 3.x before 3.0.3, does not present warnings about incoming encrypted e-mail messages that were based on revoked PGP or GPG keys, which makes it easier for remote attackers to spoof e-mail communication by leveraging a key that has a revocation signature.


definition_id: oval:org.debian:def:172003530439440878228034528950104969557
title: CVE-2010-4765 otrs2
description:
Race condition in the Kernel::System::Main::FileWrite method in Open Ticket Request System (OTRS) before 2.4.8 allows remote authenticated users to corrupt the TicketCounter.log data in opportunistic circumstances by creating tickets.


definition_id: oval:org.debian:def:17560820257965555780046898327375715760
title: CVE-2010-4766 otrs2
description:
The AgentTicketForward feature in Open Ticket Request System (OTRS) before 2.4.7 does not properly remove inline images from HTML e-mail messages, which allows remote attackers to obtain potentially sensitive image information in opportunistic circumstances by reading a forwarded message in a standard e-mail client.


definition_id: oval:org.debian:def:30089391978932340611188766124240160200
title: CVE-2010-4767 otrs2
description:
Open Ticket Request System (OTRS) before 2.3.6 does not properly handle e-mail messages in which the From line contains UTF-8 characters associated with diacritical marks and an invalid charset, which allows remote attackers to cause a denial of service (duplicate tickets and duplicate auto-responses) by sending a crafted message to a POP3 mailbox.


definition_id: oval:org.debian:def:316515878356925601324443806864861280280
title: CVE-2010-4768 otrs2
description:
Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.


definition_id: oval:org.debian:def:45222867022093442452632827246371857343
title: CVE-2010-4777 perl
description:
The Perl_reg_numbered_buff_fetch function in Perl 5.10.0, 5.12.0, 5.14.0, and other versions, when running with debugging enabled, allows context-dependent attackers to cause a denial of service (assertion failure and application exit) via crafted input that is not properly handled when using certain regular expressions, as demonstrated by causing SpamAssassin and OCSInventory to crash.


definition_id: oval:org.debian:def:146783449861366402073745188700602168844
title: CVE-2010-4802 libmojolicious-perl
description:
Commands.pm in Mojolicious before 0.999928 does not properly perform CGI environment detection, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:53738546905685508385533008359349052569
title: CVE-2010-4803 libmojolicious-perl
description:
Mojolicious before 0.999927 does not properly implement HMAC-MD5 checksums, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:307338080197882895283237501906156484282
title: CVE-2010-4818 xorg-server
description:
The GLX extension in X.Org xserver 1.7.7 allows remote authenticated users to cause a denial of service (server crash) and possibly execute arbitrary code via (1) a crafted request that triggers a client swap in glx/glxcmdsswap.c; or (2) a crafted length or (3) a negative value in the screen field in a request to glx/glxcmds.c.


definition_id: oval:org.debian:def:148888405311359946062244493181724181266
title: CVE-2010-4819 xorg-server
description:
The ProcRenderAddGlyphs function in the Render extension (render/render.c) in X.Org xserver 1.7.7 and earlier allows local users to read arbitrary memory and possibly cause a denial of service (server crash) via unspecified vectors related to an "input sanitization flaw."


definition_id: oval:org.debian:def:217694339577023127190328667366870082403
title: CVE-2010-4820 ghostscript
description:
Untrusted search path vulnerability in Ghostscript 8.62 allows local users to execute arbitrary PostScript code via a Trojan horse Postscript library file in Encoding/ under the current working directory, a different vulnerability than CVE-2010-2055.


definition_id: oval:org.debian:def:287100503429275850379025366117087067404
title: CVE-2010-4879 php-dompdf
description:
PHP remote file inclusion vulnerability in dompdf.php in dompdf 0.6.0 beta1 allows remote attackers to execute arbitrary PHP code via a URL in the input_file parameter.


definition_id: oval:org.debian:def:184002221575226755572383511275058218
title: CVE-2010-5049 zabbix
description:
SQL injection vulnerability in events.php in Zabbix 1.8.1 and earlier allows remote attackers to execute arbitrary SQL commands via the nav_time parameter.


definition_id: oval:org.debian:def:167218248046800580990561848884993841141
title: CVE-2010-5076 qt4-x11
description:
QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:19671479936576259424978297663148641036
title: CVE-2010-5077 openarena
description:
server/sv_main.c in Quake3 Arena, as used in ioquake3 before r1762, OpenArena, Tremulous, and other products, allows remote attackers to cause a denial of service (network traffic amplification) via a spoofed (1) getstatus or (2) rcon request.


definition_id: oval:org.debian:def:64762328942663631903588732418280416851
title: CVE-2010-5106 wordpress
description:
The XML-RPC remote publishing interface in xmlrpc.php in WordPress before 3.0.3 does not properly check capabilities, which allows remote authenticated users to bypass intended access restrictions, and publish, edit, or delete posts, by leveraging the Author or Contributor role.


definition_id: oval:org.debian:def:247440570683357674847963548494871669847
title: CVE-2010-5107 openssh
description:
The default configuration of OpenSSH through 6.1 enforces a fixed time limit between establishing a TCP connection and completing a login, which makes it easier for remote attackers to cause a denial of service (connection-slot exhaustion) by periodically making many new TCP connections.


definition_id: oval:org.debian:def:76846422456033990868064709192933625207
title: CVE-2010-5108 trac
description:
Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.


definition_id: oval:org.debian:def:17112184683564483007626300614539028176
title: CVE-2010-5109 claws-mail
description:
Off-by-one error in the DecompressRTF function in ytnef.c in Yerase's TNEF Stream Reader allows remote attackers to cause a denial of service (crash) via a crafted TNEF file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:89589189904678177323708309034201689444
title: CVE-2010-5110 poppler
description:
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.


definition_id: oval:org.debian:def:36720551887397471185560178791635885349
title: CVE-2010-5111 echoping
description:
Multiple buffer overflows in readline.c in Echoping 6.0.2 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted reply in the (1) TLS_readline or (2) SSL_readline function, related to the EchoPingHttps Smokeping probe.


definition_id: oval:org.debian:def:25642601473424965761324697171887038355
title: CVE-2010-5142 chef
description:
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.


definition_id: oval:org.debian:def:236125645977925351578715889900834666407
title: CVE-2010-5293 wordpress
description:
wp-includes/comment.php in WordPress before 3.0.2 does not properly whitelist trackbacks and pingbacks in the blogroll, which allows remote attackers to bypass intended spam restrictions via a crafted URL, as demonstrated by a URL that triggers a substring match.


definition_id: oval:org.debian:def:119554292678268152048941747369520956199
title: CVE-2010-5294 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in the request_filesystem_credentials function in wp-admin/includes/file.php in WordPress before 3.0.2 allow remote servers to inject arbitrary web script or HTML by providing a crafted error message for a (1) FTP or (2) SSH connection attempt.


definition_id: oval:org.debian:def:99317150104165315265124013765971817328
title: CVE-2010-5295 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action.


definition_id: oval:org.debian:def:202265724930630992826761639822202727787
title: CVE-2010-5296 wordpress
description:
wp-includes/capabilities.php in WordPress before 3.0.2, when a Multisite configuration is used, does not require the Super Admin role for the delete_users capability, which allows remote authenticated administrators to bypass intended access restrictions via a delete action.


definition_id: oval:org.debian:def:282325361271228368335630268683476035517
title: CVE-2010-5297 wordpress
description:
WordPress before 3.0.1, when a Multisite installation is used, permanently retains the "site administrators can add users" option once changed, which might allow remote authenticated administrators to bypass intended access restrictions in opportunistic circumstances via an add action after a temporary change.


definition_id: oval:org.debian:def:313924644541764494999057670871209651893
title: CVE-2010-5298 openssl
description:
Race condition in the ssl3_read_bytes function in s3_pkt.c in OpenSSL through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, allows remote attackers to inject data across sessions or cause a denial of service (use-after-free and parsing error) via an SSL connection in a multithreaded environment.


definition_id: oval:org.debian:def:292629716471232143756982774967320161844
title: CVE-2010-5312 jqueryui
description:
Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.


definition_id: oval:org.debian:def:33663588922919798656884885783989980818
title: CVE-2010-5313 linux
description:
Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.


definition_id: oval:org.debian:def:331941080066502224362896531803440075716
title: CVE-2010-5325 foomatic-filters
description:
Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a long job title.


definition_id: oval:org.debian:def:123494576352095029023497767917257164788
title: CVE-2011-0001 tgt
description:
Double free vulnerability in the iscsi_rx_handler function (usr/iscsi/iscsid.c) in the tgt daemon (tgtd) in Linux SCSI target framework (tgt) before 1.0.14, aka scsi-target-utils, allows remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via unknown vectors related to a buffer overflow during iscsi login.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:335521824807508040424004849316327567042
title: CVE-2011-0002 libuser
description:
libuser before 0.57 uses a cleartext password value of (1) !! or (2) x for new LDAP user accounts, which makes it easier for remote attackers to obtain access by specifying one of these values.


definition_id: oval:org.debian:def:288708975397619377974337915100833671574
title: CVE-2011-0003 mediawiki
description:
MediaWiki before 1.16.1, when user or site JavaScript or CSS is enabled, allows remote attackers to conduct clickjacking attacks via unspecified vectors.


definition_id: oval:org.debian:def:87983855013567647285442806051302967795
title: CVE-2011-0007 pimd
description:
pimd 2.1.5 and possibly earlier versions allows user-assisted local users to overwrite arbitrary files via a symlink attack on (1) pimd.dump when a USR1 signal is sent, or (2) pimd.cache when USR2 is sent.


definition_id: oval:org.debian:def:302199251997708732610054987242506101340
title: CVE-2011-0010 sudo
description:
check.c in sudo 1.7.x before 1.7.4p5, when a Runas group is configured, does not require a password for command execution that involves a gid change but no uid change, which allows local users to bypass an intended authentication requirement via the -g option to a sudo command.


definition_id: oval:org.debian:def:29827533768043233726976232708231627495
title: CVE-2011-0014 openssl
description:
ssl/t1_lib.c in OpenSSL 0.9.8h through 0.9.8q and 1.0.0 through 1.0.0c allows remote attackers to cause a denial of service (crash), and possibly obtain sensitive information in applications that use OpenSSL, via a malformed ClientHello handshake message that triggers an out-of-bounds memory access, aka "OCSP stapling vulnerability."


definition_id: oval:org.debian:def:320004185817441459377266210462765227742
title: CVE-2011-0015 tor
description:
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly check the amount of compression in zlib-compressed data, which allows remote attackers to cause a denial of service via a large compression factor.


definition_id: oval:org.debian:def:170144519017601616892158459854194290316
title: CVE-2011-0016 tor
description:
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not properly manage key data in memory, which might allow local users to obtain sensitive information by leveraging the ability to read memory that was previously used by a different process.


definition_id: oval:org.debian:def:167966937319201891635900931180604812664
title: CVE-2011-0017 exim4
description:
The open_log function in log.c in Exim 4.72 and earlier does not check the return value from (1) setuid or (2) setgid system calls, which allows local users to append log data to arbitrary files via a symlink attack.


definition_id: oval:org.debian:def:78018993851138030752119578467254208761
title: CVE-2011-0020 pango1.0
description:
CVE-2011-0020 pango: Heap-based buffer overflow by rendering glyph box for certain FT_Bitmap objects


definition_id: oval:org.debian:def:228020085318956046877961323009224993468
title: CVE-2011-0021 vlc
description:
Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.


definition_id: oval:org.debian:def:39455997519477325143571669250671544651
title: CVE-2011-0024 wireshark
description:
CVE-2011-0024 wireshark: heap-based buffer overflow in wireshark < 1.2 when reading malformed capture files


definition_id: oval:org.debian:def:266550079276947668473421080736256894801
title: CVE-2011-0047 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."


definition_id: oval:org.debian:def:194268282452699614862312998502614403277
title: CVE-2011-0064 pango1.0
description:
The hb_buffer_ensure function in hb-buffer.c in HarfBuzz, as used in Pango 1.28.3, Firefox, and other products, does not verify that memory reallocations succeed, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or possibly execute arbitrary code via crafted OpenType font data that triggers use of an incorrect index.


definition_id: oval:org.debian:def:257645516171829673229186086703354169034
title: CVE-2011-0191 tiff
description:
Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.


definition_id: oval:org.debian:def:307623814002994474208580628437949082782
title: CVE-2011-0192 tiff
description:
Buffer overflow in Fax4Decode in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF Internet Fax image file that has been compressed using CCITT Group 4 encoding, related to the EXPAND2D macro in libtiff/tif_fax3.h.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:125287813659582545568807888270324660417
title: CVE-2011-0216 libxml2
description:
Off-by-one error in libxml in Apple Safari before 5.0.6 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via a crafted web site.


definition_id: oval:org.debian:def:304623282948706713135156013242944214455
title: CVE-2011-0226 freetype
description:
Integer signedness error in psaux/t1decode.c in FreeType before 2.4.6, as used in CoreGraphics in Apple iOS before 4.2.9 and 4.3.x before 4.3.4 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Type 1 font in a PDF document, as exploited in the wild in July 2011.


definition_id: oval:org.debian:def:315503594576978211263174002624789485775
title: CVE-2011-0281 krb5
description:
The unparse implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (file descriptor exhaustion and daemon hang) via a principal name that triggers use of a backslash escape sequence, as demonstrated by a \n sequence.


definition_id: oval:org.debian:def:251168062058531879316960845968437907430
title: CVE-2011-0282 krb5
description:
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.6.x through 1.9, when an LDAP backend is used, allows remote attackers to cause a denial of service (NULL pointer dereference or buffer over-read, and daemon crash) via a crafted principal name.


definition_id: oval:org.debian:def:234612275953969585166906101534871039915
title: CVE-2011-0284 krb5
description:
Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.


definition_id: oval:org.debian:def:210877631275804893085722126833047053032
title: CVE-2011-0285 krb5
description:
The process_chpw_request function in schpw.c in the password-changing functionality in kadmind in MIT Kerberos 5 (aka krb5) 1.7 through 1.9 frees an invalid pointer, which allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted request that triggers an error condition.


definition_id: oval:org.debian:def:201928316909518985659015528553294849152
title: CVE-2011-0343 syslog-ng
description:
Balabit syslog-ng 2.0, 3.0, 3.1, 3.2 OSE and PE, when running on FreeBSD or HP-UX, does not properly perform cast operations, which causes syslog-ng to use a default value of -1 to create log files with insecure permissions (07777), which allows local users to read and write to these log files.


definition_id: oval:org.debian:def:260827283861288233113067690461859677570
title: CVE-2011-0402 dpkg
description:
dpkg-source in dpkg before 1.14.31 and 1.15.x allows user-assisted remote attackers to modify arbitrary files via a symlink attack on unspecified files in the .pc directory.


definition_id: oval:org.debian:def:129477154097019745495932085666555541986
title: CVE-2011-0411 postfix
description:
The STARTTLS implementation in Postfix 2.4.x before 2.4.16, 2.5.x before 2.5.12, 2.6.x before 2.6.9, and 2.7.x before 2.7.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack.


definition_id: oval:org.debian:def:101922842900651215716799756141184887818
title: CVE-2011-0413 isc-dhcp
description:
The DHCPv6 server in ISC DHCP 4.0.x and 4.1.x before 4.1.2-P1, 4.0-ESV and 4.1-ESV before 4.1-ESV-R1, and 4.2.x before 4.2.1b1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) by sending a message over IPv6 for a declined and abandoned address.


definition_id: oval:org.debian:def:74233098134126513319330332688645618031
title: CVE-2011-0414 bind9
description:
ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.


definition_id: oval:org.debian:def:307473005623005060185441819244473281936
title: CVE-2011-0418 pure-ftpd
description:
The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command.


definition_id: oval:org.debian:def:5674769826032742024217738630109190819
title: CVE-2011-0419 apr
description:
Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd.


definition_id: oval:org.debian:def:121959037428740638944729664542900835884
title: CVE-2011-0421 libzip
description:
The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.


definition_id: oval:org.debian:def:7872395354249429428108831958908168989
title: CVE-2011-0427 tor
description:
Heap-based buffer overflow in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:19206318542420687806547715769838909544
title: CVE-2011-0428 ikiwiki
description:
Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.


definition_id: oval:org.debian:def:14178748436332186495881702257781487526
title: CVE-2011-0430 openafs
description:
Double free vulnerability in the Rx server process in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions allows remote attackers to cause a denial of service and execute arbitrary code via unknown vectors.


definition_id: oval:org.debian:def:321660189720276896462749550986640262412
title: CVE-2011-0431 openafs
description:
The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which allows attackers to cause a denial of service via unknown vectors.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:285239494591292537294679224412736295656
title: CVE-2011-0432 pywebdav
description:
Multiple SQL injection vulnerabilities in the get_userinfo method in the MySQLAuthHandler class in DAVServer/mysqlauth.py in PyWebDAV before 0.9.4.1 allow remote attackers to execute arbitrary SQL commands via the (1) user or (2) pw argument.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:45388980527715852064721685451072147827
title: CVE-2011-0433 evince
description:
Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.


definition_id: oval:org.debian:def:276039420853494464646634979160257808841
title: CVE-2011-0444 wireshark
description:
Buffer overflow in the MAC-LTE dissector (epan/dissectors/packet-mac-lte.c) in Wireshark 1.2.0 through 1.2.13 and 1.4.0 through 1.4.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large number of RARs.


definition_id: oval:org.debian:def:305332301432275880622013305148915797407
title: CVE-2011-0446 rails
description:
Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.


definition_id: oval:org.debian:def:118438032966738543391445176434814462575
title: CVE-2011-0447 rails
description:
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.


definition_id: oval:org.debian:def:26235121236590244907640883208577824691
title: CVE-2011-0456 otrs2
description:
webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."


definition_id: oval:org.debian:def:79919397263062941520202437715240998134
title: CVE-2011-0465 x11-xserver-utils
description:
xrdb.c in xrdb before 1.0.9 in X.Org X11R7.6 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a (1) DHCP or (2) XDMCP message.


definition_id: oval:org.debian:def:142953110264168123692301252285842564579
title: CVE-2011-0480 ffmpeg
description:
Multiple buffer overflows in vorbis_dec.c in the Vorbis decoder in FFmpeg, as used in Google Chrome before 8.0.552.237 and Chrome OS before 8.0.552.344, allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly have unspecified other impact via a crafted WebM file, related to buffers for (1) the channel floor and (2) the channel residue.


definition_id: oval:org.debian:def:93482082162592296850331201351716641111
title: CVE-2011-0490 tor
description:
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha makes calls to Libevent within Libevent log handlers, which might allow remote attackers to cause a denial of service (daemon crash) via vectors that trigger certain log messages.


definition_id: oval:org.debian:def:292653357276190197333541956759087067242
title: CVE-2011-0491 tor
description:
The tor_realloc function in Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha does not validate a certain size value during memory allocation, which might allow remote attackers to cause a denial of service (daemon crash) via unspecified vectors, related to "underflow errors."


definition_id: oval:org.debian:def:55240781965802847708029010628140088726
title: CVE-2011-0492 tor
description:
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha allows remote attackers to cause a denial of service (assertion failure and daemon exit) via blobs that trigger a certain file size, as demonstrated by the cached-descriptors.new file.


definition_id: oval:org.debian:def:68274065528444593161009120174729855059
title: CVE-2011-0493 tor
description:
Tor before 0.2.1.29 and 0.2.2.x before 0.2.2.21-alpha might allow remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors related to malformed router caches and improper handling of integer values.


definition_id: oval:org.debian:def:99962597103165734269929351985229072827
title: CVE-2011-0495 asterisk
description:
Stack-based buffer overflow in the ast_uri_encode function in main/utils.c in Asterisk Open Source before 1.4.38.1, 1.4.39.1, 1.6.1.21, 1.6.2.15.1, 1.6.2.16.1, 1.8.1.2, 1.8.2.; and Business Edition before C.3.6.2; when running in pedantic mode allows remote authenticated users to execute arbitrary code via crafted caller ID data in vectors involving the (1) SIP channel driver, (2) URIENCODE dialplan function, or (3) AGI dialplan function.


definition_id: oval:org.debian:def:179375141575615269032346814830052609920
title: CVE-2011-0520 maradns
description:
The compress_add_dlabel_points function in dns/Compress.c in MaraDNS 1.4.03, 1.4.05, and probably other versions allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a long DNS hostname with a large number of labels, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:333842966231980500337326716794852116058
title: CVE-2011-0522 vlc
description:
The StripTags function in (1) the USF decoder (modules/codec/subtitles/subsdec.c) and (2) the Text decoder (modules/codec/subtitles/subsusf.c) in VideoLAN VLC Media Player 1.1 before 1.1.6-rc allows remote attackers to execute arbitrary code via a subtitle with an opening "<" without a closing ">" in an MKV file, which triggers heap memory corruption, as demonstrated using refined-australia-blu720p-sample.mkv.


definition_id: oval:org.debian:def:313334817877842616580892811935904941249
title: CVE-2011-0528 puppet
description:
Puppet 2.6.0 through 2.6.3 does not properly restrict access to node resources, which allows remote authenticated Puppet nodes to read or modify the resources of other nodes via unspecified vectors.


definition_id: oval:org.debian:def:262864834530273243727434316771822805741
title: CVE-2011-0530 nbd
description:
Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.


definition_id: oval:org.debian:def:233227953122817573322974901830415719946
title: CVE-2011-0531 vlc
description:
demux/mkv/mkv.hpp in the MKV demuxer plugin in VideoLAN VLC media player 1.1.6.1 and earlier allows remote attackers to cause a denial of service (crash) and execute arbitrary commands via a crafted MKV (WebM or Matroska) file that triggers memory corruption, related to "class mismatching" and the MKV_IS_ID macro.


definition_id: oval:org.debian:def:83793871411854485280595763299315978646
title: CVE-2011-0538 wireshark
description:
Wireshark 1.2.0 through 1.2.14, 1.4.0 through 1.4.3, and 1.5.0 frees an uninitialized pointer during processing of a .pcap file in the pcap-ng format, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a malformed file.


definition_id: oval:org.debian:def:276214025007849449473940410407069427685
title: CVE-2011-0539 openssh
description:
The key_certify function in usr.bin/ssh/key.c in OpenSSH 5.6 and 5.7, when generating legacy certificates using the -t command-line option in ssh-keygen, does not initialize the nonce field, which might allow remote attackers to obtain sensitive stack memory contents or make it easier to conduct hash collision attacks.


definition_id: oval:org.debian:def:110693966765031862243678205403349655582
title: CVE-2011-0541 fuse
description:
fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.


definition_id: oval:org.debian:def:64352644360547405523196715095524634764
title: CVE-2011-0542 fuse
description:
fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.


definition_id: oval:org.debian:def:223050067042207523479285869410272938635
title: CVE-2011-0543 fuse
description:
Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.


definition_id: oval:org.debian:def:1875791555247862519717133722771530294
title: CVE-2011-0633 libwww-perl
description:
The Net::HTTPS module in libwww-perl (LWP) before 6.00, as used in WWW::Mechanize, LWP::UserAgent, and other products, when running in environments that do not set the If-SSL-Cert-Subject header, does not enable full validation of SSL certificates by default, which allows remote attackers to spoof servers via man-in-the-middle (MITM) attacks involving hostnames that are not properly validated.  NOTE: it could be argued that this is a design limitation of the Net::HTTPS API, and separate implementations should be independently assigned CVE identifiers for not working around this limitation. However, because this API was modified within LWP, a single CVE identifier has been assigned.


definition_id: oval:org.debian:def:169853700890164543086457988208393832059
title: CVE-2011-0696 python-django
description:
Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a "combination of browser plugins and redirects," a related issue to CVE-2011-0447.


definition_id: oval:org.debian:def:102653630770407873165432424900938838005
title: CVE-2011-0697 python-django
description:
Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.


definition_id: oval:org.debian:def:331562131841775544303031061035558917119
title: CVE-2011-0700 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box.


definition_id: oval:org.debian:def:46920963881063946424467954381337653776
title: CVE-2011-0701 wordpress
description:
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1) draft posts or (2) private posts via a modified attachment_id parameter.


definition_id: oval:org.debian:def:26751908973855267983618159233740399471
title: CVE-2011-0702 feh
description:
The feh_unique_filename function in utils.c in feh before 1.11.2 might allow local users to overwrite arbitrary files via a symlink attack on a /tmp/feh_ temporary file.


definition_id: oval:org.debian:def:169565554801340187135254210691081416091
title: CVE-2011-0713 wireshark
description:
CVE-2011-0713 Wireshark: heap-based buffer overflow when reading malformed Nokia DCT3 phone signalling traces


definition_id: oval:org.debian:def:305523630211805046829929567957131062335
title: CVE-2011-0715 subversion
description:
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.16, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request that contains a lock token.


definition_id: oval:org.debian:def:318028387488028465847564724367861573864
title: CVE-2011-0719 samba
description:
Samba 3.x before 3.3.15, 3.4.x before 3.4.12, and 3.5.x before 3.5.7 does not perform range checks for file descriptors before use of the FD_SET macro, which allows remote attackers to cause a denial of service (stack memory corruption, and infinite loop or daemon crash) by opening a large number of files, related to (1) Winbind or (2) smbd.


definition_id: oval:org.debian:def:169754844525648881595691284422166624261
title: CVE-2011-0721 shadow
description:
Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.


definition_id: oval:org.debian:def:178674559170387362309550200907641894937
title: CVE-2011-0722 ffmpeg
description:
FFmpeg before 0.5.4, as used in MPlayer and other products, allows remote attackers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via a malformed RealMedia file.


definition_id: oval:org.debian:def:75348849328211306628934157586257346122
title: CVE-2011-0723 ffmpeg
description:
FFmpeg 0.5.x, as used in MPlayer and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed VC-1 file.


definition_id: oval:org.debian:def:66872761330738821411684534631943602874
title: CVE-2011-0727 gdm3
description:
GNOME Display Manager (gdm) 2.x before 2.32.1 allows local users to change the ownership of arbitrary files via a symlink attack on a (1) dmrc or (2) face icon file under /var/cache/gdm/.


definition_id: oval:org.debian:def:5121124218315241889718948576758205627
title: CVE-2011-0740 magpierss
description:
Cross-site scripting (XSS) vulnerability in magpie/scripts/magpie_slashbox.php in RSS Feed Reader 0.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the rss_url parameter.


definition_id: oval:org.debian:def:35570479920030380497935620798533500113
title: CVE-2011-0761 perl
description:
Perl 5.10.x allows context-dependent attackers to cause a denial of service (NULL pointer dereference and application crash) by leveraging an ability to inject arguments into a (1) getpeername, (2) readdir, (3) closedir, (4) getsockname, (5) rewinddir, (6) tell, or (7) telldir function call.


definition_id: oval:org.debian:def:142933701467059944663184496022922936059
title: CVE-2011-0762 vsftpd
description:
The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability than CVE-2010-2632.


definition_id: oval:org.debian:def:279889383926705712558929133994243262367
title: CVE-2011-0764 xpdf
description:
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a crafted Type 1 font in a PDF document, as demonstrated by testz.2184122398.pdf.


definition_id: oval:org.debian:def:326625280281721100272587435801821551995
title: CVE-2011-0766 erlang
description:
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.


definition_id: oval:org.debian:def:210879737942670853858877359697208296415
title: CVE-2011-0904 vino
description:
The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when raw encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via a large (1) X position or (2) Y position value in a framebuffer update request that triggers an out-of-bounds memory access, related to the rfbTranslateNone and rfbSendRectEncodingRaw functions.


definition_id: oval:org.debian:def:115461404350817746685634319369933856718
title: CVE-2011-0905 vino
description:
The rfbSendFramebufferUpdate function in server/libvncserver/rfbserver.c in vino-server in Vino 2.x before 2.28.3, 2.32.x before 2.32.2, 3.0.x before 3.0.2, and 3.1.x before 3.1.1, when tight encoding is used, allows remote authenticated users to cause a denial of service (daemon crash) via crafted dimensions in a framebuffer update request that triggers an out-of-bounds read operation.


definition_id: oval:org.debian:def:28919369387096557374436500415678774158
title: CVE-2011-0997 isc-dhcp
description:
dhclient in ISC DHCP 3.0.x through 4.2.x before 4.2.1-P1, 3.1-ESV before 3.1-ESV-R1, and 4.1-ESV before 4.1-ESV-R2 allows remote attackers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message, as demonstrated by a hostname that is provided to dhclient-script.


definition_id: oval:org.debian:def:186023837196294958727971444599528171948
title: CVE-2011-1000 telepathy-gabble
description:
jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media.


definition_id: oval:org.debian:def:283409798582237593884708352657741612173
title: CVE-2011-1002 avahi
description:
CVE-2011-1002 avahi: daemon infinite loop triggered by an empty UDP packet (CVE-2010-2244 fix regression)


definition_id: oval:org.debian:def:216780426681392919164857106962231623770
title: CVE-2011-1003 clamav
description:
Double free vulnerability in the vba_read_project_strings function in vba_extract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:28724446926872778949384132585485474436
title: CVE-2011-1006 libcgroup
description:
CVE-2011-1006 libcgroup: Heap-based buffer overflow by converting list of controllers for given task into an array of strings


definition_id: oval:org.debian:def:246477880550390053676379114265256949279
title: CVE-2011-1018 logwatch
description:
CVE-2011-1018 logwatch: Privilege escalation due improper sanitization of special characters in log file names


definition_id: oval:org.debian:def:280338244345875082011903860931135903291
title: CVE-2011-1022 libcgroup
description:
The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.


definition_id: oval:org.debian:def:113163305036687429047938514112051937810
title: CVE-2011-1024 openldap
description:
chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.


definition_id: oval:org.debian:def:263493738946525403029316352109885937510
title: CVE-2011-1025 openldap
description:
bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.


definition_id: oval:org.debian:def:174502152211211388349266981242963494191
title: CVE-2011-1028 smarty3
description:
The $smarty.template variable in Smarty3 allows attackers to possibly execute arbitrary PHP code via the sysplugins/smarty_internal_compile_private_special_variable.php file.


definition_id: oval:org.debian:def:33963044526258280041420251600947561438
title: CVE-2011-1031 feh
description:
The feh_unique_filename function in utils.c in feh 1.11.2 and earlier might allow local users to create arbitrary files via a symlink attack on a /tmp/feh_ temporary file, a different vulnerability than CVE-2011-0702.


definition_id: oval:org.debian:def:78609046635714149970069217135608311418
title: CVE-2011-1058 moin
description:
Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:173943396900088268295151598538722960642
title: CVE-2011-1070 v86d
description:
v86d before 0.1.10 do not verify if received netlink messages are sent by the kernel. This could allow unprivileged users to manipulate the video mode and potentially other consequences.


definition_id: oval:org.debian:def:122966018082461436367969043590761015367
title: CVE-2011-1071 glibc
description:
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.


definition_id: oval:org.debian:def:102909512839080834417538450553011937889
title: CVE-2011-1081 openldap
description:
modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.


definition_id: oval:org.debian:def:237649340243046771012405419616701629632
title: CVE-2011-1087 vlc
description:
Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation.


definition_id: oval:org.debian:def:217292421635748325248115981970154088051
title: CVE-2011-1089 glibc
description:
The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.


definition_id: oval:org.debian:def:216956111864365864120575738832079529230
title: CVE-2011-1094 kde4libs
description:
kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.


definition_id: oval:org.debian:def:339294805377233374258245201458557655154
title: CVE-2011-1095 glibc
description:
locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.


definition_id: oval:org.debian:def:63421825492965402051284689925363964863
title: CVE-2011-1097 rsync
description:
rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.


definition_id: oval:org.debian:def:41164661108559517542972285220077783739
title: CVE-2011-1098 logrotate
description:
CVE-2011-1098 logrotate: TOCTOU race condition by creation of new files (between opening the file and moment, final permissions have been applied) [information disclosure]


definition_id: oval:org.debian:def:107827862320008320441511327775484261092
title: CVE-2011-1136 tesseract
description:
In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.


definition_id: oval:org.debian:def:142832091057813112607057112579684878992
title: CVE-2011-1137 proftpd-dfsg
description:
Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.


definition_id: oval:org.debian:def:147540104655544074706491859319549180932
title: CVE-2011-1138 wireshark
description:
Off-by-one error in the dissect_6lowpan_iphc function in packet-6lowpan.c in Wireshark 1.4.0 through 1.4.3 on 32-bit platforms allows remote attackers to cause a denial of service (application crash) via a malformed 6LoWPAN IPv6 packet.


definition_id: oval:org.debian:def:51041809845592994191587156843261897301
title: CVE-2011-1139 wireshark
description:
wiretap/pcapng.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) via a pcap-ng file that contains a large packet-length field.


definition_id: oval:org.debian:def:316390494166489121893121727898087272808
title: CVE-2011-1140 wireshark
description:
Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet.


definition_id: oval:org.debian:def:42266529681931959560375946727687549003
title: CVE-2011-1141 wireshark
description:
epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (memory consumption) via (1) a long LDAP filter string or (2) an LDAP filter string containing many elements.


definition_id: oval:org.debian:def:131449342816616987743055725486222823400
title: CVE-2011-1142 wireshark
description:
Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.


definition_id: oval:org.debian:def:26232767033959149210726411132469820044
title: CVE-2011-1143 wireshark
description:
epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file.


definition_id: oval:org.debian:def:166038775874882711376314289828170038506
title: CVE-2011-1145 unixodbc
description:
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.


definition_id: oval:org.debian:def:207821864137672694416188178682173485261
title: CVE-2011-1146 libvirt
description:
libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.


definition_id: oval:org.debian:def:232890386329546264414900347771682971888
title: CVE-2011-1147 asterisk
description:
Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.


definition_id: oval:org.debian:def:117325448306979743491197835151000367685
title: CVE-2011-1154 logrotate
description:
The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.


definition_id: oval:org.debian:def:336651971097192278150544931082831421420
title: CVE-2011-1155 logrotate
description:
The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.


definition_id: oval:org.debian:def:19351807902826273047629296368625147558
title: CVE-2011-1156 feedparser
description:
feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.


definition_id: oval:org.debian:def:223311528736999223426590063121185220433
title: CVE-2011-1157 feedparser
description:
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.


definition_id: oval:org.debian:def:166414547533583669752084033876379337173
title: CVE-2011-1158 feedparser
description:
Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.


definition_id: oval:org.debian:def:36991187120773966784124998750364162539
title: CVE-2011-1159 acpid
description:
acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls.


definition_id: oval:org.debian:def:212637284304952181868228525106909769807
title: CVE-2011-1166 xen
description:
Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.


definition_id: oval:org.debian:def:131549164808337393633438259603939248607
title: CVE-2011-1174 asterisk
description:
manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data.


definition_id: oval:org.debian:def:320907118486246469073776516217437398317
title: CVE-2011-1175 asterisk
description:
tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.


definition_id: oval:org.debian:def:20701257494266467991993657884228728183
title: CVE-2011-1176 apache2
description:
The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.


definition_id: oval:org.debian:def:124538609334777066304135873799379687650
title: CVE-2011-1202 libxslt
description:
The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.


definition_id: oval:org.debian:def:147543808105300660153119180274892479559
title: CVE-2011-1400 tex-common
description:
The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.


definition_id: oval:org.debian:def:204898961792054492286979987807954405326
title: CVE-2011-1401 ikiwiki
description:
ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the "meta stylesheet" directive, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.


definition_id: oval:org.debian:def:315670354492150919938692885484953201978
title: CVE-2011-1407 exim4
description:
The DKIM implementation in Exim 4.7x before 4.76 permits matching for DKIM identities to apply to lookup items, instead of only strings, which allows remote attackers to execute arbitrary code or access a filesystem via a crafted identity.


definition_id: oval:org.debian:def:206001468591582069128783251726138908486
title: CVE-2011-1409 fex
description:
Frams's Fast File EXchange (F*EX, aka fex) 20100208, and possibly other versions before 20110610, allows remote attackers to bypass authentication and upload arbitrary files via a request that lacks an authentication ID.


definition_id: oval:org.debian:def:64203418974785484117602954574115442263
title: CVE-2011-1412 ioquake3
description:
sys/sys_unix.c in the ioQuake3 engine on Unix and Linux, as used in World of Padman 1.5.x before 1.5.1.1 and OpenArena 0.8.x-15 and 0.8.x-16, allows remote game servers to execute arbitrary commands via shell metacharacters in a long fs_game variable.


definition_id: oval:org.debian:def:326133142821639613220732598099446021308
title: CVE-2011-1425 xmlsec1
description:
xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification.


definition_id: oval:org.debian:def:210731072832666193603821625657361310219
title: CVE-2011-1428 weechat
description:
Wee Enhanced Environment for Chat (aka WeeChat) 0.3.4 and earlier does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, related to incorrect use of the GnuTLS API.


definition_id: oval:org.debian:def:229281389655568036526770050572071432074
title: CVE-2011-1429 mutt
description:
Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.


definition_id: oval:org.debian:def:277767055256088846909319987882535460518
title: CVE-2011-1433 otrs2
description:
The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.


definition_id: oval:org.debian:def:207138624966096919671944594268590660766
title: CVE-2011-1485 policykit-1
description:
Race condition in the pkexec utility and polkitd daemon in PolicyKit (aka polkit) 0.96 allows local users to gain privileges by executing a setuid program from pkexec, related to the use of the effective user ID instead of the real user ID.


definition_id: oval:org.debian:def:206651004028510427167078521567782644885
title: CVE-2011-1486 libvirt
description:
libvirtd in libvirt before 0.9.0 does not use thread-safe error reporting, which allows remote attackers to cause a denial of service (crash) by causing multiple threads to report errors at the same time.


definition_id: oval:org.debian:def:97756998915570462255755523263652575239
title: CVE-2011-1487 perl
description:
The (1) lc, (2) lcfirst, (3) uc, and (4) ucfirst functions in Perl 5.10.x, 5.11.x, and 5.12.x through 5.12.3, and 5.13.x through 5.13.11, do not apply the taint attribute to the return value upon processing tainted input, which might allow context-dependent attackers to bypass the taint protection mechanism via a crafted string.


definition_id: oval:org.debian:def:53259661768002160141666847236607602454
title: CVE-2011-1488 rsyslog
description:
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent within short periods of time.


definition_id: oval:org.debian:def:235068300511030490179177424408915850649
title: CVE-2011-1489 rsyslog
description:
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages were logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset.


definition_id: oval:org.debian:def:147292653019060950925337760326811364162
title: CVE-2011-1490 rsyslog
description:
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when multiple rulesets were used and some output batches contained messages belonging to more than one ruleset. A local attacker could cause denial of the rsyslogd daemon service via a log message belonging to more than one ruleset


definition_id: oval:org.debian:def:201108217857325494542818313456162037045
title: CVE-2011-1491 roundcube
description:
The login form in Roundcube Webmail before 0.5.1 does not properly handle a correctly authenticated but unintended login attempt, which makes it easier for remote authenticated users to obtain sensitive information by arranging for a victim to login to the attacker's account and then compose an e-mail message, related to a "login CSRF" issue.


definition_id: oval:org.debian:def:291947324758036438168301228041566219316
title: CVE-2011-1492 roundcube
description:
steps/utils/modcss.inc in Roundcube Webmail before 0.5.1 does not properly verify that a request is an expected request for an external Cascading Style Sheets (CSS) stylesheet, which allows remote authenticated users to trigger arbitrary outbound TCP connections from the server, and possibly obtain sensitive information, via a crafted request.


definition_id: oval:org.debian:def:35302022416305663573641108454354685943
title: CVE-2011-1496 tmux
description:
tmux 1.3 and 1.4 does not properly drop group privileges, which allows local users to gain utmp group privileges via a filename to the -S command-line option.


definition_id: oval:org.debian:def:183324749113168594157256140870021220466
title: CVE-2011-1498 httpcomponents-client
description:
Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.


definition_id: oval:org.debian:def:127125422955854457530631555917605944463
title: CVE-2011-1499 tinyproxy
description:
acl.c in Tinyproxy before 1.8.3, when an Allow configuration setting specifies a CIDR block, permits TCP connections from all IP addresses, which makes it easier for remote attackers to hide the origin of web traffic by leveraging the open HTTP proxy server.


definition_id: oval:org.debian:def:187597326376388893013253092184413948304
title: CVE-2011-1500 pithos
description:
PreferencesPithosDialog.py in Pithos 0.3.7 does not properly restrict permissions for the .config/pithos.ini file in a user's home directory, which allows local users to obtain Pandora credentials by reading this file.


definition_id: oval:org.debian:def:35119557453782845636102253238806952943
title: CVE-2011-1507 asterisk
description:
Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 do not restrict the number of unauthenticated sessions to certain interfaces, which allows remote attackers to cause a denial of service (file descriptor exhaustion and disk space exhaustion) via a series of TCP connections.


definition_id: oval:org.debian:def:75014636423792727034180401348915162206
title: CVE-2011-1518 otrs2
description:
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) 2.4.x before 2.4.10 and 3.x before 3.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:51328086770530795802325149745431475574
title: CVE-2011-1521 python2.7
description:
The urllib and urllib2 modules in Python 2.x before 2.7.2 and 3.x before 3.2.1 process Location headers that specify redirection to file: URLs, which makes it easier for remote attackers to obtain sensitive information or cause a denial of service (resource consumption) via a crafted URL, as demonstrated by the file:///etc/passwd and file:///dev/zero URLs.


definition_id: oval:org.debian:def:61955221330999567465084017192087085267
title: CVE-2011-1522 doctrine
description:
Multiple SQL injection vulnerabilities in the Doctrine\DBAL\Platforms\AbstractPlatform::modifyLimitQuery function in Doctrine 1.x before 1.2.4 and 2.x before 2.0.3 allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset field.


definition_id: oval:org.debian:def:114233048656737502876416930558069811282
title: CVE-2011-1523 icinga
description:
Cross-site scripting (XSS) vulnerability in statusmap.c in statusmap.cgi in Nagios 3.2.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the layer parameter.


definition_id: oval:org.debian:def:338332365307939801708323351570155937448
title: CVE-2011-1527 krb5
description:
The kdb_ldap plugin in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a kinit operation with incorrect string case for the realm, related to the is_principal_in_realm, krb5_set_error_message, krb5_ldap_get_principal, and process_as_req functions.


definition_id: oval:org.debian:def:219124085687111605971493937005305628782
title: CVE-2011-1528 krb5
description:
The krb5_ldap_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the LDAP back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, related to the locked_check_p function.  NOTE: the Berkeley DB vector is covered by CVE-2011-4151.


definition_id: oval:org.debian:def:170039285926434234542625531973528676560
title: CVE-2011-1529 krb5
description:
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.


definition_id: oval:org.debian:def:241537518672758773333316401701359799958
title: CVE-2011-1530 krb5
description:
The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.


definition_id: oval:org.debian:def:284008841415071304424745965296521047682
title: CVE-2011-1548 logrotate
description:
The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/.


definition_id: oval:org.debian:def:137306036594266789872858969848247495255
title: CVE-2011-1552 xpdf
description:
t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1 font in a PDF document, a different vulnerability than CVE-2011-0764.


definition_id: oval:org.debian:def:167348826247010410358994360657746056356
title: CVE-2011-1553 xpdf
description:
Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory write, a different vulnerability than CVE-2011-0764.


definition_id: oval:org.debian:def:83484094893636413029589330393444426928
title: CVE-2011-1554 xpdf
description:
Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Type 1 font that triggers an invalid memory read, integer overflow, and invalid pointer dereference, a different vulnerability than CVE-2011-0764.


definition_id: oval:org.debian:def:9269350417036331795648671492309988930
title: CVE-2011-1574 libmodplug
description:
Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.


definition_id: oval:org.debian:def:284122342329972529352402027006725115444
title: CVE-2011-1575 pure-ftpd
description:
The STARTTLS implementation in ftp_parser.c in Pure-FTPd before 1.0.30 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted FTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


definition_id: oval:org.debian:def:230202004877009320563122160715847917965
title: CVE-2011-1578 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.


definition_id: oval:org.debian:def:301904145795555687837583956406856272544
title: CVE-2011-1579 mediawiki
description:
The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \2f\2a and \2a\2f hex strings to surround CSS comments.


definition_id: oval:org.debian:def:112386213318085609312809842694076146140
title: CVE-2011-1580 mediawiki
description:
The transwiki import functionality in MediaWiki before 1.16.3 does not properly check privileges, which allows remote authenticated users to perform imports from any wgImportSources wiki via a crafted POST request.


definition_id: oval:org.debian:def:75928302659590613181433258135548998683
title: CVE-2011-1583 xen
description:
Multiple integer overflows in tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allow local users to cause a denial of service and possibly execute arbitrary code via a crafted paravirtualised guest kernel image that triggers (1) a buffer overflow during a decompression loop or (2) an out-of-bounds read in the loader involving unspecified length fields.


definition_id: oval:org.debian:def:272050715467062199132020782433512549704
title: CVE-2011-1587 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.


definition_id: oval:org.debian:def:201930751511195856793264360915633196763
title: CVE-2011-1589 libmojolicious-perl
description:
Directory traversal vulnerability in Path.pm in Mojolicious before 1.16 allows remote attackers to read arbitrary files via a %2f..%2f (encoded slash dot dot slash) in a URI.


definition_id: oval:org.debian:def:282710311872023405490013773201212831468
title: CVE-2011-1591 wireshark
description:
Stack-based buffer overflow in the DECT dissector in epan/dissectors/packet-dect.c in Wireshark 1.4.x before 1.4.5 allows remote attackers to execute arbitrary code via a crafted .pcap file.


definition_id: oval:org.debian:def:8003808314985191140726859032148585061
title: CVE-2011-1595 rdesktop
description:
Directory traversal vulnerability in the disk_create function in disk.c in rdesktop before 1.7.0, when disk redirection is enabled, allows remote RDP servers to read or overwrite arbitrary files via a .. (dot dot) in a pathname.


definition_id: oval:org.debian:def:178973222057604551328112226601647343641
title: CVE-2011-1599 asterisk
description:
manager.c in the Manager Interface in Asterisk Open Source 1.4.x before 1.4.40.1, 1.6.1.x before 1.6.1.25, 1.6.2.x before 1.6.2.17.3, and 1.8.x before 1.8.3.3 and Asterisk Business Edition C.x.x before C.3.6.4 does not properly check for the system privilege, which allows remote authenticated users to execute arbitrary commands via an Originate action that has an Async header in conjunction with an Application header.


definition_id: oval:org.debian:def:333958786412227802714736778761156511521
title: CVE-2011-1659 glibc
description:
Integer overflow in posix/fnmatch.c in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a long UTF8 string that is used in an fnmatch call with a crafted pattern argument, a different vulnerability than CVE-2011-1071.


definition_id: oval:org.debian:def:310945856267693179924527791927494158467
title: CVE-2011-1675 util-linux
description:
mount in util-linux 2.19 and earlier attempts to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.


definition_id: oval:org.debian:def:222578664925371728516062487085874536466
title: CVE-2011-1677 util-linux
description:
mount in util-linux 2.19 and earlier does not remove the /etc/mtab~ lock file after a failed attempt to add a mount entry, which has unspecified impact and local attack vectors.


definition_id: oval:org.debian:def:246384774592415383618606398298616595571
title: CVE-2011-1678 cifs-utils
description:
smbfs in Samba 3.5.8 and earlier attempts to use (1) mount.cifs to append to the /etc/mtab file and (2) umount.cifs to append to the /etc/mtab.tmp file without first checking whether resource limits would interfere, which allows local users to trigger corruption of the /etc/mtab file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.


definition_id: oval:org.debian:def:174586230919368565374489098726208050968
title: CVE-2011-1681 open-vm-tools
description:
vmware-hgfsmounter in VMware Open Virtual Machine Tools (aka open-vm-tools) 8.4.2-261024 and earlier attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to trigger corruption of this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.


definition_id: oval:org.debian:def:119800835390381595320165834181579110689
title: CVE-2011-1684 vlc
description:
Heap-based buffer overflow in the MP4_ReadBox_skcr function in libmp4.c in the MP4 demultiplexer in VideoLAN VLC media player 1.x before 1.1.9 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted MP4 file.


definition_id: oval:org.debian:def:257481229972166479574031756051724631580
title: CVE-2011-1716 xymon
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in Xymon before 4.3.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:78765257790994134089532983186237347629
title: CVE-2011-1720 postfix
description:
The SMTP server in Postfix before 2.5.13, 2.6.x before 2.6.10, 2.7.x before 2.7.4, and 2.8.x before 2.8.3, when certain Cyrus SASL authentication methods are enabled, does not create a new server handle after client authentication fails, which allows remote attackers to cause a denial of service (heap memory corruption and daemon crash) or possibly execute arbitrary code via an invalid AUTH command with one method followed by an AUTH command with a different method.


definition_id: oval:org.debian:def:111186222969436827158202529067191887500
title: CVE-2011-1749 nfs-utils
description:
The nfs_addmntent function in support/nfs/nfs_mntent.c in the mount.nsf tool in nfs-utils before 1.2.4 attempts to append to the /etc/mtab file without first checking whether resource limits would interfere, which allows local users to corrupt this file via a process with a small RLIMIT_FSIZE value, a related issue to CVE-2011-1089.


definition_id: oval:org.debian:def:170114185696373006053256266037591946279
title: CVE-2011-1752 subversion
description:
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion before 1.6.17, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a request for a baselined WebDAV resource, as exploited in the wild in May 2011.


definition_id: oval:org.debian:def:9875361254587624103647252957814908238
title: CVE-2011-1753 ejabberd
description:
expat_erl.c in ejabberd before 2.1.7 and 3.x before 3.0.0-alpha-3, and exmpp before 0.9.7, does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:241222987134500587888783967651203799554
title: CVE-2011-1755 jabberd2
description:
jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:27367564084084368361272429383027999044
title: CVE-2011-1756 citadel
description:
modules/xmpp/serv_xmpp.c in Citadel 7.86 and earlier does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:111397286279163960910446989521183382225
title: CVE-2011-1761 libmodplug
description:
Multiple stack-based buffer overflows in the (1) abc_new_macro and (2) abc_new_umacro functions in src/load_abc.cpp in libmodplug before 0.8.8.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ABC file.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:220446086997847486003578412328659509409
title: CVE-2011-1762 wordpress
description:
A flaw exists in Wordpress related to the 'wp-admin/press-this.php 'script improperly checking user permissions when publishing posts. This may allow a user with 'Contributor-level' privileges to post as if they had 'publish_posts' permission.


definition_id: oval:org.debian:def:101936370224550563611497241596744561481
title: CVE-2011-1764 exim4
description:
Format string vulnerability in the dkim_exim_verify_finish function in src/dkim.c in Exim before 4.76 might allow remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via format string specifiers in data used in DKIM logging, as demonstrated by an identity field containing a % (percent) character.


definition_id: oval:org.debian:def:127826327751573834495559946698781401492
title: CVE-2011-1769 systemtap
description:
SystemTap 1.4 and earlier, when unprivileged (aka stapusr) mode is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs context variable access.


definition_id: oval:org.debian:def:226348010407717640345023746894423121311
title: CVE-2011-1777 libarchive
description:
Multiple buffer overflows in the (1) heap_add_entry and (2) relocate_dir functions in archive_read_support_format_iso9660.c in libarchive through 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted ISO9660 image.


definition_id: oval:org.debian:def:183927712851588167610204513377872743645
title: CVE-2011-1778 libarchive
description:
Buffer overflow in libarchive through 2.8.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TAR archive.


definition_id: oval:org.debian:def:140804526100805809389538584019963995798
title: CVE-2011-1779 libarchive
description:
Multiple use-after-free vulnerabilities in libarchive 2.8.4 and 2.8.5 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted (1) TAR archive or (2) ISO9660 image.


definition_id: oval:org.debian:def:55084564178581369052071729918683677480
title: CVE-2011-1781 systemtap
description:
SystemTap 1.4, when unprivileged (aka stapusr) mode is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) via a crafted ELF program with DWARF expressions that are not properly handled by a stap script that performs stack unwinding (aka backtracing).


definition_id: oval:org.debian:def:78515359224212043464696455248271809729
title: CVE-2011-1782 gimp
description:
Heap-based buffer overflow in the read_channel_data function in file-psp.c in the Paint Shop Pro (PSP) plugin in GIMP 2.6.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a PSP_COMP_RLE (aka RLE compression) image file that begins a long run count at the end of the image.  NOTE: some of these details are obtained from third party information.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2010-4543.


definition_id: oval:org.debian:def:27094289599150099821152348945952028586
title: CVE-2011-1783 subversion
description:
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.


definition_id: oval:org.debian:def:19651545877966838867481664687027241685
title: CVE-2011-1784 keepalived
description:
The pidfile_write function in core/pidfile.c in keepalived 1.2.2 and earlier uses 0666 permissions for the (1) keepalived.pid, (2) checkers.pid, and (3) vrrp.pid files in /var/run/, which allows local users to kill arbitrary processes by writing a PID to one of these files.


definition_id: oval:org.debian:def:316659518961005793584180984855905733515
title: CVE-2011-1787 open-vm-tools
description:
Race condition in mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to gain privileges on the guest OS by mounting a filesystem on top of an arbitrary directory.


definition_id: oval:org.debian:def:46377972647324913594493442860669106346
title: CVE-2011-1829 apt
description:
APT before 0.8.15.2 does not properly validate inline GPG signatures, which allows man-in-the-middle attackers to install modified packages via vectors involving lack of an initial clearsigned message.


definition_id: oval:org.debian:def:331594156051294720842399408675291137125
title: CVE-2011-1841 libmojolicious-perl
description:
Cross-site scripting (XSS) vulnerability in the link_to helper in Mojolicious before 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:112200316762184686255616959056084137784
title: CVE-2011-1843 tinyproxy
description:
Integer overflow in conf.c in Tinyproxy before 1.8.3 might allow remote attackers to bypass intended access restrictions in opportunistic circumstances via a TCP connection, related to improper handling of invalid port numbers.


definition_id: oval:org.debian:def:26142754908470586818357757566483578547
title: CVE-2011-1898 xen
description:
Xen 4.1 before 4.1.1 and 4.0 before 4.0.2, when using PCI passthrough on Intel VT-d chipsets that do not have interrupt remapping, allows guest OS users to gain host OS privileges by "using DMA to generate MSI interrupts by writing to the interrupt injection registers."


definition_id: oval:org.debian:def:24125541843551705278199429350704724244
title: CVE-2011-1907 bind9
description:
ISC BIND 9.8.x before 9.8.0-P1, when Response Policy Zones (RPZ) RRset replacement is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an RRSIG query.


definition_id: oval:org.debian:def:124741466128721426966120752274188144199
title: CVE-2011-1910 bind9
description:
Off-by-one error in named in ISC BIND 9.x before 9.7.3-P1, 9.8.x before 9.8.0-P2, 9.4-ESV before 9.4-ESV-R4-P1, and 9.6-ESV before 9.6-ESV-R4-P1 allows remote DNS servers to cause a denial of service (assertion failure and daemon exit) via a negative response containing large RRSIG RRsets.


definition_id: oval:org.debian:def:299918403842852289157076829760605624772
title: CVE-2011-1921 subversion
description:
The mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz short_circuit option is disabled, does not properly enforce permissions for files that had been publicly readable in the past, which allows remote attackers to obtain sensitive information via a replay REPORT operation.


definition_id: oval:org.debian:def:228659604315595627731025032125291538347
title: CVE-2011-1922 unbound
description:
daemon/worker.c in Unbound 1.x before 1.4.10, when debugging functionality and the interface-automatic option are enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted DNS request that triggers improper error handling.


definition_id: oval:org.debian:def:167738417878275681490106587623160450470
title: CVE-2011-1924 tor
description:
Buffer overflow in the policy_summarize function in or/policies.c in Tor before 0.2.1.30 allows remote attackers to cause a denial of service (directory authority crash) via a crafted policy that triggers creation of a long port list.


definition_id: oval:org.debian:def:221734112382526047200280443381276636626
title: CVE-2011-1925 nbd
description:
nbd-server.c in Network Block Device (nbd-server) 2.9.21 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) by causing a negotiation failure, as demonstrated by specifying a name for a non-existent export.


definition_id: oval:org.debian:def:8125046841307785407713246152893473699
title: CVE-2011-1928 apr
description:
The fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library 1.4.3 and 1.4.4, and the Apache HTTP Server 2.2.18, allows remote attackers to cause a denial of service (infinite loop) via a URI that does not match unspecified types of wildcard patterns, as demonstrated by attacks against mod_autoindex in httpd when a /*/WEB-INF/ configuration pattern is used.  NOTE: this issue exists because of an incorrect fix for CVE-2011-0419.


definition_id: oval:org.debian:def:334677585201404825440274987294030455598
title: CVE-2011-1929 dovecot
description:
lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message.


definition_id: oval:org.debian:def:218719399049233011743986704435639373610
title: CVE-2011-1930 klibc
description:
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.


definition_id: oval:org.debian:def:87705944558847755179943983208232225383
title: CVE-2011-1932 widelands
description:
Directory traversal vulnerability in io/filesystem/filesystem.cc in Widelands before 15.1 might allow remote attackers to overwrite arbitrary files via . (dot) characters in a pathname that is used for a file transfer in an Internet game.


definition_id: oval:org.debian:def:133436202921627928822511650299366638615
title: CVE-2011-1935 libpcap
description:
pcap-linux.c in libpcap 1.1.1 before commit ea9432fabdf4b33cbc76d9437200e028f1c47c93 when snaplen is set may truncate packets, which might allow remote attackers to send arbitrary data while avoiding detection via crafted packets.


definition_id: oval:org.debian:def:210096096975090283543897387165636449223
title: CVE-2011-1944 libxml2
description:
Integer overflow in xpath.c in libxml2 2.6.x through 2.6.32 and 2.7.x through 2.7.8, and libxml 1.8.16 and earlier, allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted XML file that triggers a heap-based buffer overflow when adding a new namespace node, related to handling of XPath expressions.


definition_id: oval:org.debian:def:3212775826995638935035633236342567876
title: CVE-2011-1945 openssl
description:
The elliptic curve cryptography (ECC) subsystem in OpenSSL 1.0.0d and earlier, when the Elliptic Curve Digital Signature Algorithm (ECDSA) is used for the ECDHE_ECDSA cipher suite, does not properly implement curves over binary fields, which makes it easier for context-dependent attackers to determine private keys via a timing attack and a lattice calculation.


definition_id: oval:org.debian:def:80125136772190498257864498659263858833
title: CVE-2011-1947 fetchmail
description:
fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2) STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging the request but not sending additional packets.


definition_id: oval:org.debian:def:197909014929877810028720711555542275310
title: CVE-2011-1951 syslog-ng
description:
lib/logmatcher.c in Balabit syslog-ng before 3.2.4, when the global flag is set and when using PCRE 8.12 and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via a message that does not match a regular expression.


definition_id: oval:org.debian:def:337129178722510315776543095047945655361
title: CVE-2011-1956 wireshark
description:
The bytes_repr_len function in Wireshark 1.4.5 uses an incorrect pointer argument, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via arbitrary TCP traffic.


definition_id: oval:org.debian:def:253110637326366579371264544155893892573
title: CVE-2011-1958 wireshark
description:
CVE-2011-1958 wireshark (64bit): NULL pointer dereference by processing of a corrupted Diameter dictionary file


definition_id: oval:org.debian:def:140708933811521732752602259399379862471
title: CVE-2011-1959 wireshark
description:
The snoop_read function in wiretap/snoop.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 does not properly handle certain virtualizable buffers, which allows remote attackers to cause a denial of service (application crash) via a large length value in a snoop file that triggers a stack-based buffer over-read.


definition_id: oval:org.debian:def:4214686412189694651959645689223005678
title: CVE-2011-2082 request-tracker4
description:
The vulnerable-passwords script in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not update the password-hash algorithm for disabled user accounts, which makes it easier for context-dependent attackers to determine cleartext passwords, and possibly use these passwords after accounts are re-enabled, via a brute-force attack on the database.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0009.


definition_id: oval:org.debian:def:65176791554318871354397356826566252532
title: CVE-2011-2083 request-tracker4
description:
Multiple cross-site scripting (XSS) vulnerabilities in Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:131218152619862254302473534136142931546
title: CVE-2011-2084 request-tracker4
description:
Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to read (1) hashes of former passwords and (2) ticket correspondence history by leveraging access to a privileged account.


definition_id: oval:org.debian:def:15346191657363208891972879555690657666
title: CVE-2011-2085 request-tracker4
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in Best Practical Solutions RT before 3.8.12 and 4.x before 4.0.6 allow remote attackers to hijack the authentication of arbitrary users.


definition_id: oval:org.debian:def:242513975634902161003129054411256459528
title: CVE-2011-2145 open-vm-tools
description:
mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1, when a Solaris or FreeBSD guest OS is used, allows guest OS users to modify arbitrary guest OS files via unspecified vectors, related to a "procedural error."


definition_id: oval:org.debian:def:158717684206675512976451734492350935937
title: CVE-2011-2146 open-vm-tools
description:
mount.vmhgfs in the VMware Host Guest File System (HGFS) in VMware Workstation 7.1.x before 7.1.4, VMware Player 3.1.x before 3.1.4, VMware Fusion 3.1.x before 3.1.3, VMware ESXi 3.5 through 4.1, and VMware ESX 3.0.3 through 4.1 allows guest OS users to determine the existence of host OS files and directories via unspecified vectors.


definition_id: oval:org.debian:def:304083752248721760989580594137613546438
title: CVE-2011-2160 ffmpeg
description:
The VC-1 decoding functionality in FFmpeg before 0.5.4, as used in MPlayer and other products, does not properly restrict read operations, which allows remote attackers to have an unspecified impact via a crafted VC-1 file, a related issue to CVE-2011-0723.


definition_id: oval:org.debian:def:79271541203945959536514133017015017965
title: CVE-2011-2161 ffmpeg
description:
The ape_read_header function in ape.c in libavformat in FFmpeg before 0.5.4, as used in MPlayer, VideoLAN VLC media player, and other products, allows remote attackers to cause a denial of service (application crash) via an APE (aka Monkey's Audio) file that contains a header but no frames.


definition_id: oval:org.debian:def:86290635952654959587436796177147351858
title: CVE-2011-2162 ffmpeg
description:
Multiple unspecified vulnerabilities in FFmpeg 0.4.x through 0.6.x, as used in MPlayer 1.0 and other products, in Mandriva Linux 2009.0, 2010.0, and 2010.1; Corporate Server 4.0 (aka CS4.0); and Mandriva Enterprise Server 5 (aka MES5) have unknown impact and attack vectors, related to issues "originally discovered by Google Chrome developers."


definition_id: oval:org.debian:def:197596406567099642891112398695783401676
title: CVE-2011-2166 dovecot
description:
script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script.


definition_id: oval:org.debian:def:40300392073097391480993165012365677149
title: CVE-2011-2167 dovecot
description:
script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script.


definition_id: oval:org.debian:def:325573860730064003521994218433274865554
title: CVE-2011-2174 wireshark
description:
Double free vulnerability in the tvb_uncompress function in epan/tvbuff.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a packet with malformed data that uses zlib compression.


definition_id: oval:org.debian:def:187763717506965591685150684338767862091
title: CVE-2011-2175 wireshark
description:
Integer underflow in the visual_read function in wiretap/visual.c in Wireshark 1.2.x before 1.2.17 and 1.4.x before 1.4.7 allows remote attackers to cause a denial of service (application crash) via a malformed Visual Networks file that triggers a heap-based buffer over-read.


definition_id: oval:org.debian:def:102193100135206477409392009297488512725
title: CVE-2011-2176 network-manager
description:
GNOME NetworkManager before 0.8.6 does not properly enforce the auth_admin element in PolicyKit, which allows local users to bypass intended wireless network sharing restrictions via unspecified vectors.


definition_id: oval:org.debian:def:230012676290162122682723615828425917944
title: CVE-2011-2178 libvirt
description:
The virSecurityManagerGetPrivateData function in security/security_manager.c in libvirt 0.8.8 through 0.9.1 uses the wrong argument for a sizeof call, which causes incorrect processing of "security manager private data" that "reopens disk probing" and might allow guest OS users to read arbitrary files on the host OS.  NOTE: this vulnerability exists because of a CVE-2010-2238 regression.


definition_id: oval:org.debian:def:276428543110987493497519074993943147500
title: CVE-2011-2179 icinga
description:
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in (1) Nagios 3.2.3 and (2) Icinga before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the expand parameter, as demonstrated by an (a) command action or a (b) hosts action.


definition_id: oval:org.debian:def:241035034360367613741532145425592052665
title: CVE-2011-2185 fabric
description:
Fabric before 1.1.0 allows local users to overwrite arbitrary files via a symlink attack on (1) a /tmp/fab.*.tar file or (2) certain other files in the top level of /tmp/.


definition_id: oval:org.debian:def:18275715287096491205770342006189794817
title: CVE-2011-2187 xscreensaver
description:
xscreensaver before 5.14 crashes during activation and leaves the screen unlocked when in Blank Only Mode and when DPMS is disabled, which allows local attackers to access resources without authentication.


definition_id: oval:org.debian:def:196029716055954902721629252899271562917
title: CVE-2011-2188 lua-expat
description:
LuaExpat before 1.2.0 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:239121447303382681922216458207403082571
title: CVE-2011-2189 vsftpd
description:
net/core/net_namespace.c in the Linux kernel 2.6.32 and earlier does not properly handle a high rate of creation and cleanup of network namespaces, which makes it easier for remote attackers to cause a denial of service (memory consumption) via requests to a daemon that requires a separate namespace per connection, as demonstrated by vsftpd.


definition_id: oval:org.debian:def:4554089465616772135525296091545011126
title: CVE-2011-2192 curl
description:
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.


definition_id: oval:org.debian:def:197694184037969838619220981376758350546
title: CVE-2011-2194 vlc
description:
Integer overflow in the XSPF playlist parser in VideoLAN VLC media player 0.8.5 through 1.1.9 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors that trigger a heap-based buffer overflow.


definition_id: oval:org.debian:def:13693086483422886617778936900531105021
title: CVE-2011-2198 vte
description:
The "insert-blank-characters" capability in caps.c in gnome-terminal (vte) before 0.28.1 allows remote authenticated users to cause a denial of service (CPU and memory consumption and crash) via a crafted file, as demonstrated by a file containing the string "\033[100000000000000000@".


definition_id: oval:org.debian:def:134365160180070294210551422138115227738
title: CVE-2011-2199 tftp-hpa
description:
Buffer overflow in tftp-hpa before 5.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via the utimeout option.


definition_id: oval:org.debian:def:132751202338092465233249810345987830995
title: CVE-2011-2200 dbus
description:
The _dbus_header_byteswap function in dbus-marshal-header.c in D-Bus (aka DBus) 1.2.x before 1.2.28, 1.4.x before 1.4.12, and 1.5.x before 1.5.4 does not properly handle a non-native byte order, which allows local users to cause a denial of service (connection loss), obtain potentially sensitive information, or conduct unspecified state-modification attacks via crafted messages.


definition_id: oval:org.debian:def:174103468680054637698336195431632937199
title: CVE-2011-2201 libdata-formvalidator-perl
description:
The Data::FormValidator module 4.66 and earlier for Perl, when untaint_all_constraints is enabled, does not properly preserve the taint attribute of data, which might allow remote attackers to bypass the taint protection mechanism via form input.


definition_id: oval:org.debian:def:100843757256715860079377256964747579513
title: CVE-2011-2205 prosody
description:
Prosody before 0.8.1 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.


definition_id: oval:org.debian:def:339095641307917861242672311664110234103
title: CVE-2011-2216 asterisk
description:
reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.2 does not initialize certain strings, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed Contact header.


definition_id: oval:org.debian:def:40282637964930642526719454881180142697
title: CVE-2011-2300 virtualbox-guest-additions-iso
description:
Unspecified vulnerability in Oracle VM VirtualBox 3.0, 3.1, 3.2, and 4.0 through 4.0.8 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Guest Additions for Windows.


definition_id: oval:org.debian:def:176037980317735633493532481648033249899
title: CVE-2011-2464 bind9
description:
Unspecified vulnerability in ISC BIND 9 9.6.x before 9.6-ESV-R4-P3, 9.7.x before 9.7.3-P3, and 9.8.x before 9.8.0-P4 allows remote attackers to cause a denial of service (named daemon crash) via a crafted UPDATE request.


definition_id: oval:org.debian:def:287704942843509017591313144678955066493
title: CVE-2011-2465 bind9
description:
Unspecified vulnerability in ISC BIND 9 9.8.0, 9.8.0-P1, 9.8.0-P2, and 9.8.1b1, when recursion is enabled and the Response Policy Zone (RPZ) contains DNAME or certain CNAME records, allows remote attackers to cause a denial of service (named daemon crash) via an unspecified query.


definition_id: oval:org.debian:def:239029540800207560001281653054054865617
title: CVE-2011-2477 icinga
description:
Multiple cross-site scripting (XSS) vulnerabilities in config.c in config.cgi in Icinga before 1.4.1, when escape_html_tags is disabled, allow remote attackers to inject arbitrary web script or HTML via a JavaScript expression, as demonstrated by the onload attribute of a BODY element located after a check-host-alive! sequence, a different vulnerability than CVE-2011-2179.


definition_id: oval:org.debian:def:270027451765867773893371835054549240816
title: CVE-2011-2485 gdk-pixbuf
description:
The gdk_pixbuf__gif_image_load function in gdk-pixbuf/io-gif.c in gdk-pixbuf before 2.23.5 does not properly handle certain return values, which allows remote attackers to cause a denial of service (memory consumption) via a crafted GIF image file.


definition_id: oval:org.debian:def:139584417311696759043273685109573663025
title: CVE-2011-2500 nfs-utils
description:
The host_reliable_addrinfo function in support/export/hostname.c in nfs-utils before 1.2.4 does not properly use DNS to verify access to NFS exports, which allows remote attackers to mount filesystems by establishing crafted DNS A and PTR records.


definition_id: oval:org.debian:def:207986768573564862250518565231542218832
title: CVE-2011-2502 systemtap
description:
runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate modules when a module path is specified by a user for user-space probing, which allows local users in the stapusr group to gain privileges via a crafted module in the search path in the -u argument.


definition_id: oval:org.debian:def:255100957179209397130715924557242843632
title: CVE-2011-2503 systemtap
description:
The insert_module function in runtime/staprun/staprun_funcs.c in the systemtap runtime tool (staprun) in SystemTap before 1.6 does not properly validate a module when loading it, which allows local users to gain privileges via a race condition between the signature validation and the module initialization.


definition_id: oval:org.debian:def:171539417535744630255619400145158505943
title: CVE-2011-2510 dokuwiki
description:
Cross-site scripting (XSS) vulnerability in the RSS embedding feature in DokuWiki before 2011-05-25a Rincewind allows remote attackers to inject arbitrary web script or HTML via a link.


definition_id: oval:org.debian:def:205534745247958039729155056841186601339
title: CVE-2011-2513 icedtea-web
description:
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to obtain the username and full path of the home and cache directories by accessing properties of the ClassLoader.


definition_id: oval:org.debian:def:322390046202701078436493250110759598093
title: CVE-2011-2514 icedtea-web
description:
The Java Network Launching Protocol (JNLP) implementation in IcedTea6 1.9.x before 1.9.9 and before 1.8.9, and IcedTea-Web 1.1.x before 1.1.1 and before 1.0.4, allows remote attackers to trick victims into granting access to local files by modifying the content of the Java Web Start Security Warning dialog box to represent a different filename than the file for which access will be granted.


definition_id: oval:org.debian:def:260305202695127840665320657223185211101
title: CVE-2011-2515 packagekit
description:
PackageKit 0.6.17 allows installation of unsigned RPM packages as though they were signed which may allow installation of non-trusted packages and execution of arbitrary code.


definition_id: oval:org.debian:def:318044397371486035835846814532779348191
title: CVE-2011-2516 xml-security-c
description:
Off-by-one error in the XML signature feature in Apache XML Security for C++ 1.6.0, as used in Shibboleth before 2.4.3 and possibly other products, allows remote attackers to cause a denial of service (crash) via a signature using a large RSA key, which triggers a buffer overflow.


definition_id: oval:org.debian:def:65046475181956126449207934698935947361
title: CVE-2011-2522 samba
description:
Multiple cross-site request forgery (CSRF) vulnerabilities in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allow remote attackers to hijack the authentication of administrators for requests that (1) shut down daemons, (2) start daemons, (3) add shares, (4) remove shares, (5) add printers, (6) remove printers, (7) add user accounts, or (8) remove user accounts, as demonstrated by certain start, stop, and restart parameters to the status program.


definition_id: oval:org.debian:def:300052564777726484630272723918085324148
title: CVE-2011-2524 libsoup2.4
description:
Directory traversal vulnerability in soup-uri.c in SoupServer in libsoup before 2.35.4 allows remote attackers to read arbitrary files via a %2e%2e (encoded dot dot) in a URI.


definition_id: oval:org.debian:def:268633027924118889108375392243166643650
title: CVE-2011-2529 asterisk
description:
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.6.x before 1.6.2.18.1 and 1.8.x before 1.8.4.3 does not properly handle '\0' characters in SIP packets, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted packet.


definition_id: oval:org.debian:def:173039427904255861398007472992686631360
title: CVE-2011-2531 prosody
description:
Prosody 0.8.x before 0.8.1, when MySQL is used, assigns an incorrect data type to the value column in certain tables, which might allow remote attackers to cause a denial of service (data truncation) by sending a large amount of data.


definition_id: oval:org.debian:def:205531048741209926571311665821948208871
title: CVE-2011-2532 prosody
description:
The json.decode function in util/json.lua in Prosody 0.8.x before 0.8.1 might allow remote attackers to cause a denial of service (infinite loop) via invalid JSON data, as demonstrated by truncated data.


definition_id: oval:org.debian:def:239484104889316202550302070628618767682
title: CVE-2011-2533 dbus
description:
The configure script in D-Bus (aka DBus) 1.2.x before 1.2.28 allows local users to overwrite arbitrary files via a symlink attack on an unspecified file in /tmp/.


definition_id: oval:org.debian:def:169615235843171151954524116908270761906
title: CVE-2011-2535 asterisk
description:
chan_iax2.c in the IAX2 channel driver in Asterisk Open Source 1.4.x before 1.4.41.1, 1.6.2.x before 1.6.2.18.1, and 1.8.x before 1.8.4.3, and Asterisk Business Edition C.3 before C.3.7.3, accesses a memory address contained in an option control frame, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a crafted frame.


definition_id: oval:org.debian:def:125667870158867489816183541689861484496
title: CVE-2011-2536 asterisk
description:
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.4.x before 1.4.41.2, 1.6.2.x before 1.6.2.18.2, and 1.8.x before 1.8.4.4, and Asterisk Business Edition C.3.x before C.3.7.3, disregards the alwaysauthreject option and generates different responses for invalid SIP requests depending on whether the user account exists, which allows remote attackers to enumerate account names via a series of requests.


definition_id: oval:org.debian:def:111838992899773067335261941523410859985
title: CVE-2011-2587 vlc
description:
Heap-based buffer overflow in the DemuxAudioSipr function in real.c in the RealMedia demuxer in VideoLAN VLC media player 1.1.x before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real Media file.


definition_id: oval:org.debian:def:82302789629986944449112845435107030457
title: CVE-2011-2588 vlc
description:
Heap-based buffer overflow in the AVI_ChunkRead_strf function in libavi.c in the AVI demuxer in VideoLAN VLC media player before 1.1.11 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted AVI media file.


definition_id: oval:org.debian:def:5051067514422885768376760729179915382
title: CVE-2011-2597 wireshark
description:
The Lucent/Ascend file parser in Wireshark 1.2.x before 1.2.18, 1.4.x through 1.4.7, and 1.6.0 allows remote attackers to cause a denial of service (infinite loop) via malformed packets.


definition_id: oval:org.debian:def:78891272773461682626816624251193805316
title: CVE-2011-2665 asterisk
description:
reqresp_parser.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.4.3 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a SIP packet with a Contact header that lacks a < (less than) character.


definition_id: oval:org.debian:def:267074710364314909111742030787166137001
title: CVE-2011-2666 asterisk
description:
The default configuration of the SIP channel driver in Asterisk Open Source 1.4.x through 1.4.41.2 and 1.6.2.x through 1.6.2.18.2 does not enable the alwaysauthreject option, which allows remote attackers to enumerate account names by making a series of invalid SIP requests and observing the differences in the responses for different usernames, a different vulnerability than CVE-2011-2536.


definition_id: oval:org.debian:def:185927115197837490806901257065995392006
title: CVE-2011-2684 foo2zjs
description:
foo2zjs before 20110722dfsg-3ubuntu1 as packaged in Ubuntu, 20110722dfsg-1 as packaged in Debian unstable, and 20090908dfsg-5.1+squeeze0 as packaged in Debian squeeze create temporary files insecurely, which allows local users to write over arbitrary files via a symlink attack on /tmp/foo2zjs.


definition_id: oval:org.debian:def:328752911708587088287915841549855153495
title: CVE-2011-2685 libreoffice
description:
Stack-based buffer overflow in the Lotus Word Pro import filter in LibreOffice before 3.3.3 allows remote attackers to execute arbitrary code via a crafted .lwp file.


definition_id: oval:org.debian:def:86551366909539922483337393439482342897
title: CVE-2011-2688 libapache2-mod-authnz-external
description:
SQL injection vulnerability in mysql/mysql-auth.pl in the mod_authnz_external module 3.2.5 and earlier for the Apache HTTP Server allows remote attackers to execute arbitrary SQL commands via the user field.


definition_id: oval:org.debian:def:331722947692705698347266888918043038977
title: CVE-2011-2694 samba
description:
Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).


definition_id: oval:org.debian:def:34267728657933338043372975604757557015
title: CVE-2011-2696 libsndfile
description:
CVE-2011-2696 libsndfile: Application crash due integer overflow by processing certain PAF audio files


definition_id: oval:org.debian:def:34910855064579121075405386888834700800
title: CVE-2011-2697 foomatic-filters
description:
foomatic-rip-hplip in HP Linux Imaging and Printing (HPLIP) 3.11.5 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file.


definition_id: oval:org.debian:def:315923803184079236414991380841252801866
title: CVE-2011-2703 mapserver
description:
Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commands via vectors related to (1) OGC filter encoding or (2) WMS time support.


definition_id: oval:org.debian:def:185174932852773210466085513709470843655
title: CVE-2011-2704 mapserver
description:
Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter encoding.


definition_id: oval:org.debian:def:89888446064544017636224873263204641215
title: CVE-2011-2709 libgssglue
description:
libgssapi and libgssglue before 0.4 do not properly check privileges, which allows local users to load untrusted configuration files and execute arbitrary code via the GSSAPI_MECH_CONF environment variable, as demonstrated using mount.nfs.


definition_id: oval:org.debian:def:138360491216442967943619553672855497834
title: CVE-2011-2713 libreoffice
description:
oowriter in OpenOffice.org 3.3.0 and LibreOffice before 3.4.3 allows user-assisted remote attackers to cause a denial of service (crash) via a crafted DOC file that triggers an out-of-bounds read in the DOC sprm parser.


definition_id: oval:org.debian:def:224486931662500840333338822371930140181
title: CVE-2011-2716 busybox
description:
The DHCP client (udhcpc) in BusyBox before 1.20.0 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in the (1) HOST_NAME, (2) DOMAIN_NAME, (3) NIS_DOMAIN, and (4) TFTP_SERVER_NAME host name options.


definition_id: oval:org.debian:def:292638946745601800940930485749597622688
title: CVE-2011-2721 clamav
description:
Off-by-one error in the cli_hm_scan function in matcher-hash.c in libclamav in ClamAV before 0.97.2 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message that is not properly handled during certain hash calculations.


definition_id: oval:org.debian:def:323944197937936508662339011741700965994
title: CVE-2011-2724 cifs-utils
description:
The check_mtab function in client/mount.cifs.c in mount.cifs in smbfs in Samba 3.5.10 and earlier does not properly verify that the (1) device name and (2) mountpoint strings are composed of valid characters, which allows local users to cause a denial of service (mtab corruption) via a crafted string.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-0547.


definition_id: oval:org.debian:def:186644155754940965309280279123701000102
title: CVE-2011-2728 perl
description:
The bsd_glob function in the File::Glob module for Perl before 5.14.2 allows context-dependent attackers to cause a denial of service (crash) via a glob expression with the GLOB_ALTDIRFUNC flag, which triggers an uninitialized pointer dereference.


definition_id: oval:org.debian:def:88909370407709991474046499163236274638
title: CVE-2011-2729 commons-daemon
description:
native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.


definition_id: oval:org.debian:def:281383175884720725479158113850815189375
title: CVE-2011-2746 otrs2
description:
Unspecified vulnerability in Kernel/Modules/AdminPackageManager.pm in OTRS-Core in Open Ticket Request System (OTRS) 2.x before 2.4.11 and 3.x before 3.0.10 allows remote authenticated administrators to read arbitrary files via unknown vectors.


definition_id: oval:org.debian:def:339601794093951706730045748622139405001
title: CVE-2011-2748 isc-dhcp
description:
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted DHCP packet.


definition_id: oval:org.debian:def:156579937917959191532445081371596852187
title: CVE-2011-2749 isc-dhcp
description:
The server in ISC DHCP 3.x and 4.x before 4.2.2, 3.1-ESV before 3.1-ESV-R3, and 4.1-ESV before 4.1-ESV-R3 allows remote attackers to cause a denial of service (daemon exit) via a crafted BOOTP packet.


definition_id: oval:org.debian:def:95248388273088111512321491292981502788
title: CVE-2011-2764 ioquake3
description:
The FS_CheckFilenameIsNotExecutable function in qcommon/files.c in the ioQuake3 engine 1.36 and earlier, as used in World of Padman, Smokin' Guns, OpenArena, Tremulous, and ioUrbanTerror, does not properly determine dangerous file extensions, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file.


definition_id: oval:org.debian:def:85537382123806802117945759598606748564
title: CVE-2011-2765 pyro
description:
pyro before 3.15 unsafely handles pid files in temporary directory locations and opening the pid file as root. An attacker can use this flaw to overwrite arbitrary files via symlinks.


definition_id: oval:org.debian:def:319739342251635914807256290906875828106
title: CVE-2011-2766 libfcgi-perl
description:
The FCGI (aka Fast CGI) module 0.70 through 0.73 for Perl, as used by CGI::Fast, uses environment variable values from one request during processing of a later request, which allows remote attackers to bypass authentication via crafted HTTP headers.


definition_id: oval:org.debian:def:54951967974241009936277632120886769586
title: CVE-2011-2767 libapache2-mod-perl2
description:
mod_perl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because (contrary to the documentation) there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting unprivileged users to run Perl code in the context of the user account that runs Apache HTTP Server processes.


definition_id: oval:org.debian:def:9752941145493927325598811917839632918
title: CVE-2011-2768 tor
description:
Tor before 0.2.2.34, when configured as a client or bridge, sends a TLS certificate chain as part of an outgoing OR connection, which allows remote relays to bypass intended anonymity properties by reading this chain and then determining the set of entry guards that the client or bridge had selected.


definition_id: oval:org.debian:def:328039791450371712419887054067742709784
title: CVE-2011-2769 tor
description:
Tor before 0.2.2.34, when configured as a bridge, accepts the CREATE and CREATE_FAST values in the Command field of a cell within an OR connection that it initiated, which allows remote relays to enumerate bridges by using these values.


definition_id: oval:org.debian:def:3421100783066846846505444608336706837
title: CVE-2011-2770 man2html
description:
Cross-site scripting (XSS) vulnerability in man2html.cgi.c in man2html 1.6, and possibly other version, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to error messages.


definition_id: oval:org.debian:def:94857611684871839022561193936188492147
title: CVE-2011-2776 super
description:
Buffer overflow in the Error function in super.c in Super 3.30.0 might allow local users to execute arbitrary code via vectors related to syslog logging.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:334795606798817398200627859782905933115
title: CVE-2011-2777 acpid
description:
samples/powerbtn/powerbtn.sh in acpid (aka acpid2) 2.0.16 and earlier uses the pidof program incorrectly, which allows local users to gain privileges by running a program with the name kded4 and a DBUS_SESSION_BUS_ADDRESS environment variable containing commands.


definition_id: oval:org.debian:def:235489890619079072053710301226059632279
title: CVE-2011-2778 tor
description:
Multiple heap-based buffer overflows in Tor before 0.2.2.35 allow remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by (1) establishing a SOCKS connection to SocksPort or (2) leveraging a SOCKS proxy configuration.


definition_id: oval:org.debian:def:308902969233448338891699552425224990768
title: CVE-2011-2821 libxml2
description:
Double free vulnerability in libxml2, as used in Google Chrome before 13.0.782.215, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted XPath expression.


definition_id: oval:org.debian:def:118928087582485816204382483514951641246
title: CVE-2011-2834 libxml2
description:
Double free vulnerability in libxml2, as used in Google Chrome before 14.0.835.163, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.


definition_id: oval:org.debian:def:285203112314083888674194129094318892359
title: CVE-2011-2895 libxfont
description:
The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896.


definition_id: oval:org.debian:def:321072947719497530768783967745611028911
title: CVE-2011-2896 cups
description:
The LZW decompressor in the LWZReadByte function in giftoppm.c in the David Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in filter/image-gif.c in CUPS before 1.4.7, the LZWReadByte function in plug-ins/common/file-gif-load.c in GIMP 2.6.11 and earlier, the LZWReadByte function in img/gifread.c in XPCE in SWI-Prolog 5.10.4 and earlier, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows remote attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2895.


definition_id: oval:org.debian:def:258268058013055387780552878962638949654
title: CVE-2011-2902 xpdf
description:
zxpdf in xpdf before 3.02-19 as packaged in Debian unstable and 3.02-12+squeeze1 as packaged in Debian squeeze deletes temporary files insecurely, which allows remote attackers to delete arbitrary files via a crafted .pdf.gz file name.


definition_id: oval:org.debian:def:78042053278880255013809217347245462197
title: CVE-2011-2903 tcptrack
description:
Heap-based buffer overflow in tcptrack before 1.4.2 might allow attackers to execute arbitrary code via a long command line argument. NOTE: this is only a vulnerability in limited scenarios in which tcptrack is "configured as a handler for other applications." This issue might not qualify for inclusion in CVE.


definition_id: oval:org.debian:def:253049456226290213689294476103675124726
title: CVE-2011-2904 zabbix
description:
Cross-site scripting (XSS) vulnerability in acknow.php in Zabbix before 1.8.6 allows remote attackers to inject arbitrary web script or HTML via the backurl parameter.


definition_id: oval:org.debian:def:101047373904787693522849716914914921773
title: CVE-2011-2910 ax25-tools
description:
The AX.25 daemon (ax25d) in ax25-tools before 0.0.8-13 does not check the return value of a setuid call. The setuid call is responsible for dropping privileges but if the call fails the daemon would continue to run with root privileges which can allow possible privilege escalation.


definition_id: oval:org.debian:def:85434142686526625716654716200557125002
title: CVE-2011-2911 libmodplug
description:
Integer overflow in the CSoundFile::ReadWav function in src/load_wav.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted WAV file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:158399109205106294264636678924910184524
title: CVE-2011-2912 libmodplug
description:
Stack-based buffer overflow in the CSoundFile::ReadS3M function in src/load_s3m.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted S3M file with an invalid offset.


definition_id: oval:org.debian:def:17304183138084098905593482429594653708
title: CVE-2011-2913 libmodplug
description:
Off-by-one error in the CSoundFile::ReadAMS function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (stack memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of samples.


definition_id: oval:org.debian:def:106750959616399951381523276925562670930
title: CVE-2011-2914 libmodplug
description:
Off-by-one error in the CSoundFile::ReadDSM function in src/load_dms.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted DSM file with a large number of samples.


definition_id: oval:org.debian:def:310373529213874631244445338444383438226
title: CVE-2011-2915 libmodplug
description:
Off-by-one error in the CSoundFile::ReadAMS2 function in src/load_ams.cpp in libmodplug before 0.8.8.4 allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via a crafted AMS file with a large number of instruments.


definition_id: oval:org.debian:def:206375953473151466752220749293896059732
title: CVE-2011-2924 foomatic-filters
description:
foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the debug mode was enabled. This flaw may be exploited by a local attacker to conduct symlink attacks by overwriting arbitrary files accessible with the privileges of the user running the foomatic-rip universal print filter.


definition_id: oval:org.debian:def:130236322366326314795554014269153705943
title: CVE-2011-2930 rails
description:
Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in activerecord/lib/active_record/connection_adapters/ in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allow remote attackers to execute arbitrary SQL commands via a crafted column name.


definition_id: oval:org.debian:def:297071318974385133918361376251184908714
title: CVE-2011-2931 rails
description:
Cross-site scripting (XSS) vulnerability in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.


definition_id: oval:org.debian:def:206377990391994087386070146474013142542
title: CVE-2011-2932 rails
description:
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a "UTF-8 escaping vulnerability."


definition_id: oval:org.debian:def:223449395567650272758253531028331984921
title: CVE-2011-2937 roundcube
description:
Cross-site scripting (XSS) vulnerability in the UI messages functionality in Roundcube Webmail before 0.5.4 allows remote attackers to inject arbitrary web script or HTML via the _mbox parameter to the default URI.


definition_id: oval:org.debian:def:47127404504876416735460687814770210932
title: CVE-2011-2940 stunnel4
description:
stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.


definition_id: oval:org.debian:def:113166552256387706870119010545462100864
title: CVE-2011-2943 pidgin
description:
The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly validate characters in nicknames, which allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted nickname that is not properly handled in a WHO response.


definition_id: oval:org.debian:def:133131679451435979356156074458570293169
title: CVE-2011-2964 foomatic-filters
description:
foomaticrip.c in foomatic-rip in foomatic-filters in Foomatic 4.0.6 allows remote attackers to execute arbitrary code via a crafted *FoomaticRIPCommandLine field in a .ppd file, a different vulnerability than CVE-2011-2697.


definition_id: oval:org.debian:def:262799667862085183089388687515721823856
title: CVE-2011-2975 mapserver
description:
Double free vulnerability in the msAddImageSymbol function in mapsymbol.c in MapServer before 6.0.1 might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact via crafted mapfile data.


definition_id: oval:org.debian:def:301743745480184367009042785420251822782
title: CVE-2011-3012 ioquake3
description:
The ioQuake3 engine, as used in World of Padman 1.2 and earlier, Tremulous 1.1.0, and ioUrbanTerror 2007-12-20, does not check for dangerous file extensions before writing to the quake3 directory, which allows remote attackers to execute arbitrary code via a crafted third-party addon that creates a Trojan horse DLL file, a different vulnerability than CVE-2011-2764.


definition_id: oval:org.debian:def:85279211194300473393302378069982521465
title: CVE-2011-3102 libxml2
description:
Off-by-one error in libxml2, as used in Google Chrome before 19.0.1084.46 and other products, allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:193423612128545070391665475766946985483
title: CVE-2011-3122 wordpress
description:
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Media security."


definition_id: oval:org.debian:def:165867114296413004383270794578178904629
title: CVE-2011-3125 wordpress
description:
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Various security hardening."


definition_id: oval:org.debian:def:156762432819006760722249861876672073277
title: CVE-2011-3126 wordpress
description:
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via canonical redirects.


definition_id: oval:org.debian:def:96937768653416380745192529211852143276
title: CVE-2011-3127 wordpress
description:
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a frame in a third-party HTML document, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.


definition_id: oval:org.debian:def:93958939206077380352320064222688078523
title: CVE-2011-3128 wordpress
description:
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote attackers to obtain sensitive data via vectors related to wp-includes/post.php.


definition_id: oval:org.debian:def:224568814050757109652950917568829380156
title: CVE-2011-3129 wordpress
description:
The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerous security settings," has unknown impact and attack vectors, possibly related to dangerous filenames.


definition_id: oval:org.debian:def:72583077224255789965054349434372750691
title: CVE-2011-3130 wordpress
description:
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors related to "Taxonomy query hardening," possibly involving SQL injection.


definition_id: oval:org.debian:def:124375266066341754030055307132650338746
title: CVE-2011-3131 xen
description:
Xen 4.1.1 and earlier allows local guest OS kernels with control of a PCI[E] device to cause a denial of service (CPU consumption and host hang) via many crafted DMA requests that are denied by the IOMMU, which triggers a livelock.


definition_id: oval:org.debian:def:171271343991627569732095156459197380842
title: CVE-2011-3146 librsvg
description:
librsvg before 2.34.1 uses the node name to identify the type of node, which allows context-dependent attackers to cause a denial of service (NULL pointer dereference) and possibly execute arbitrary code via a SVG file with a node with the element name starting with "fe," which is misidentified as a RsvgFilterPrimitive.


definition_id: oval:org.debian:def:239907965487463054477702999998265055121
title: CVE-2011-3147 nova
description:
Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem.


definition_id: oval:org.debian:def:281150211949920432450752026524434027271
title: CVE-2011-3148 pam
description:
Stack-based buffer overflow in the _assemble_line function in modules/pam_env/pam_env.c in Linux-PAM (aka pam) before 1.1.5 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via a long string of white spaces at the beginning of the ~/.pam_environment file.


definition_id: oval:org.debian:def:272349417999851874186821706503328060767
title: CVE-2011-3149 pam
description:
The _expand_arg function in the pam_env module (modules/pam_env/pam_env.c) in Linux-PAM (aka pam) before 1.1.5 does not properly handle when environment variable expansion can overflow, which allows local users to cause a denial of service (CPU consumption).


definition_id: oval:org.debian:def:195664189851369794367702907011120509023
title: CVE-2011-3153 lightdm
description:
dmrc.c in Light Display Manager (aka LightDM) before 1.1.1 allows local users to read arbitrary files via a symlink attack on ~/.dmrc.


definition_id: oval:org.debian:def:301789698507476866189319035325841587903
title: CVE-2011-3170 cups
description:
The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier does not properly handle the first code word in an LZW stream, which allows remote attackers to trigger a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted stream, a different vulnerability than CVE-2011-2896.


definition_id: oval:org.debian:def:4826658266363014817451697560904339011
title: CVE-2011-3184 pidgin
description:
The msn_httpconn_parse_data function in httpconn.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.0 does not properly handle HTTP 100 responses, which allows remote attackers to cause a denial of service (incorrect memory access and application crash) via vectors involving a crafted server message.


definition_id: oval:org.debian:def:60654610738959813305252271499400677923
title: CVE-2011-3186 rails
description:
CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.


definition_id: oval:org.debian:def:222864645061820374070569728152325548321
title: CVE-2011-3192 apache2
description:
The byterange filter in the Apache HTTP Server 1.3.x, 2.0.x through 2.0.64, and 2.2.x through 2.2.19 allows remote attackers to cause a denial of service (memory and CPU consumption) via a Range header that expresses multiple overlapping ranges, as exploited in the wild in August 2011, a different vulnerability than CVE-2007-0086.


definition_id: oval:org.debian:def:297924573039575777943741820624133434864
title: CVE-2011-3193 pango1.0
description:
Heap-based buffer overflow in the Lookup_MarkMarkPos function in the HarfBuzz module (harfbuzz-gpos.c), as used by Qt before 4.7.4 and Pango, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted font file.


definition_id: oval:org.debian:def:214151391214598893459165160277416092883
title: CVE-2011-3194 qt4-x11
description:
Buffer overflow in the TIFF reader in gui/image/qtiffhandler.cpp in Qt 4.7.4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the TIFFTAG_SAMPLESPERPIXEL tag in a greyscale TIFF image with multiple samples per pixel.


definition_id: oval:org.debian:def:156281211402181066507408593569870438043
title: CVE-2011-3200 rsyslog
description:
Stack-based buffer overflow in the parseLegacySyslogMsg function in tools/syslogd.c in rsyslogd in rsyslog 4.6.x before 4.6.8 and 5.2.0 through 5.8.4 might allow remote attackers to cause a denial of service (application exit) via a long TAG in a legacy syslog message.


definition_id: oval:org.debian:def:254337760657647306367470346483976324526
title: CVE-2011-3207 openssl
description:
crypto/x509/x509_vfy.c in OpenSSL 1.0.x before 1.0.0e does not initialize certain structure members, which makes it easier for remote attackers to bypass CRL validation by using a nextUpdate value corresponding to a time in the past.


definition_id: oval:org.debian:def:175931078639864701761960989343923217134
title: CVE-2011-3210 openssl
description:
The ephemeral ECDH ciphersuite functionality in OpenSSL 0.9.8 through 0.9.8r and 1.0.x before 1.0.0e does not ensure thread safety during processing of handshake messages from clients, which allows remote attackers to cause a denial of service (daemon crash) via out-of-order messages that violate the TLS protocol.


definition_id: oval:org.debian:def:137881748873057170159719695633820805158
title: CVE-2011-3211 bcfg2
description:
The server in Bcfg2 1.1.2 and earlier, and 1.2 prerelease, allows remote attackers to execute arbitrary commands via shell metacharacters in data received from a client.


definition_id: oval:org.debian:def:157108759895953194478636695772275719534
title: CVE-2011-3256 freetype
description:
FreeType 2 before 2.4.7, as used in CoreGraphics in Apple iOS before 5, Mandriva Enterprise Server 5, and possibly other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font, a different vulnerability than CVE-2011-0226.


definition_id: oval:org.debian:def:81892966176452159738691693582238509365
title: CVE-2011-3262 xen
description:
tools/libxc/xc_dom_bzimageloader.c in Xen 3.2, 3.3, 4.0, and 4.1 allows local users to cause a denial of service (management software infinite loop and management domain resource consumption) via unspecified vectors related to "Lack of error checking in the decompression loop."


definition_id: oval:org.debian:def:68902902238758479019661340128556762708
title: CVE-2011-3263 zabbix
description:
zabbix_agentd in Zabbix before 1.8.6 and 1.9.x before 1.9.4 allows context-dependent attackers to cause a denial of service (CPU consumption) by executing the vfs.file.cksum command for a special device, as demonstrated by the /dev/urandom device.


definition_id: oval:org.debian:def:150310603060373572893459854904143884144
title: CVE-2011-3264 zabbix
description:
Zabbix before 1.8.6 allows remote attackers to obtain sensitive information via an invalid srcfld2 parameter to popup.php, which reveals the installation path in an error message.


definition_id: oval:org.debian:def:98217925143983672435775318113892016395
title: CVE-2011-3265 zabbix
description:
popup.php in Zabbix before 1.8.7 allows remote attackers to read the contents of arbitrary database tables via a modified srctbl parameter.


definition_id: oval:org.debian:def:100452121069212253412658428011954254420
title: CVE-2011-3266 wireshark
description:
The proto_tree_add_item function in Wireshark 1.6.0 through 1.6.1 and 1.4.0 through 1.4.8, when the IKEv1 protocol dissector is used, allows user-assisted remote attackers to cause a denial of service (infinite loop) via vectors involving a malformed IKE packet and many items in a tree.


definition_id: oval:org.debian:def:976476139484407664417574186911155461
title: CVE-2011-3323 quagga
description:
The OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (out-of-bounds memory access and daemon crash) via a Link State Update message with an invalid IPv6 prefix length.


definition_id: oval:org.debian:def:57483252148848590253847472928994853488
title: CVE-2011-3324 quagga
description:
The ospf6_lsa_is_changed function in ospf6_lsa.c in the OSPFv3 implementation in ospf6d in Quagga before 0.99.19 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via trailing zero values in the Link State Advertisement (LSA) header list of an IPv6 Database Description message.


definition_id: oval:org.debian:def:9245020894939981161709441520859103750
title: CVE-2011-3325 quagga
description:
ospf_packet.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via (1) a 0x0a type field in an IPv4 packet header or (2) a truncated IPv4 Hello packet.


definition_id: oval:org.debian:def:141738931822815023496054519910832747476
title: CVE-2011-3326 quagga
description:
The ospf_flood function in ospf_flood.c in ospfd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) via an invalid Link State Advertisement (LSA) type in an IPv4 Link State Update message.


definition_id: oval:org.debian:def:229947500865804754865535114870236862589
title: CVE-2011-3327 quagga
description:
Heap-based buffer overflow in the ecommunity_ecom2str function in bgp_ecommunity.c in bgpd in Quagga before 0.99.19 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code by sending a crafted BGP UPDATE message over IPv4.


definition_id: oval:org.debian:def:130984362664692532793463352419144181974
title: CVE-2011-3341 openttd
description:
Multiple off-by-one errors in order_cmd.cpp in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted CMD_INSERT_ORDER command.


definition_id: oval:org.debian:def:13509051040753791519649722259152371273
title: CVE-2011-3342 openttd
description:
Multiple buffer overflows in OpenTTD before 1.1.3 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via vectors related to (1) NAME, (2) PLYR, (3) CHTS, or (4) AIPL (aka AI config) chunk loading from a savegame.


definition_id: oval:org.debian:def:326200919624640577682975436187996122174
title: CVE-2011-3343 openttd
description:
Multiple buffer overflows in OpenTTD before 1.1.3 allow local users to cause a denial of service (daemon crash) or possibly gain privileges via (1) a crafted BMP file with RLE compression or (2) crafted dimensions in a BMP file.


definition_id: oval:org.debian:def:998333512585558743449085176710737458
title: CVE-2011-3348 apache2
description:
The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.


definition_id: oval:org.debian:def:117957808546365454747954527383190336020
title: CVE-2011-3349 lightdm
description:
lightdm before 0.9.6 writes in .dmrc and Xauthority files using root permissions while the files are in user controlled folders. A local user can overwrite root-owned files via a symlink, which can allow possible privilege escalation.


definition_id: oval:org.debian:def:184680908655593892499180631694554993370
title: CVE-2011-3354 quassel
description:
The CtcpParser::packedReply method in core/ctcpparser.cpp in Quassel before 0.7.3 allows remote attackers to cause a denial of service (crash) via a crafted Client-To-Client Protocol (CTCP) request, as demonstrated in the wild in September 2011.


definition_id: oval:org.debian:def:146858701971229816556109695846168356176
title: CVE-2011-3360 wireshark
description:
Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.


definition_id: oval:org.debian:def:139729232266639113676094005570999470042
title: CVE-2011-3361 backuppc
description:
Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action to index.cgi.


definition_id: oval:org.debian:def:89547909581168613727579147786111947497
title: CVE-2011-3362 ffmpeg
description:
Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and libav through 0.7.1, allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Chinese AVS video (aka CAVS) file.


definition_id: oval:org.debian:def:22522850805462933284676090007763923502
title: CVE-2011-3368 apache2
description:
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.


definition_id: oval:org.debian:def:276201466550693206934675328186087541838
title: CVE-2011-3369 etherape
description:
The add_conversation function in conversations.c in EtherApe before 0.9.12 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an RPC packet, related to the get_rpc function in decode_proto.c.


definition_id: oval:org.debian:def:322208978530194030824920072196001128445
title: CVE-2011-3377 icedtea-web
description:
The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.


definition_id: oval:org.debian:def:215958265072463431741355027375631728425
title: CVE-2011-3389 asterisk
description:
The SSL protocol, as used in certain configurations in Microsoft Windows and Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Opera, and other products, encrypts data by using CBC mode with chained initialization vectors, which allows man-in-the-middle attackers to obtain plaintext HTTP headers via a blockwise chosen-boundary attack (BCBA) on an HTTPS session, in conjunction with JavaScript code that uses (1) the HTML5 WebSocket API, (2) the Java URLConnection API, or (3) the Silverlight WebClient API, aka a "BEAST" attack.


definition_id: oval:org.debian:def:280966294029369273355625098513857446118
title: CVE-2011-3439 freetype
description:
FreeType in CoreGraphics in Apple iOS before 5.0.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a document.


definition_id: oval:org.debian:def:30299903452177697063510436668094913604
title: CVE-2011-3482 wireshark
description:
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.2 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:16408585646455539292125692701296837098
title: CVE-2011-3483 wireshark
description:
Wireshark 1.6.x before 1.6.2 allows remote attackers to cause a denial of service (application crash) via a malformed capture file that leads to an invalid root tvbuff, related to a "buffer exception handling vulnerability."


definition_id: oval:org.debian:def:67606175806905860098587202516148813719
title: CVE-2011-3484 wireshark
description:
The unxorFrame function in epan/dissectors/packet-opensafety.c in the OpenSafety dissector in Wireshark 1.6.x before 1.6.2 does not properly validate a certain frame size, which allows remote attackers to cause a denial of service (loop and application crash) via a malformed packet.


definition_id: oval:org.debian:def:16228527754150100851152385227303835583
title: CVE-2011-3504 ffmpeg
description:
The Matroska format decoder in FFmpeg before 0.8.3 does not properly allocate memory, which allows remote attackers to execute arbitrary code via a crafted file.


definition_id: oval:org.debian:def:305725636151170602795555696158692601181
title: CVE-2011-3581 ldns
description:
Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns before 1.6.11 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Resource Record (RR) with an unknown type containing input that is longer than a specified length.


definition_id: oval:org.debian:def:169900286825451680842123021727701843845
title: CVE-2011-3585 cifs-utils
description:
Multiple race conditions in the (1) mount.cifs and (2) umount.cifs programs in Samba 3.6 allow local users to cause a denial of service (mounting outage) via a SIGKILL signal during a time window when the /etc/mtab~ file exists.


definition_id: oval:org.debian:def:163560391404081313619410214627423849690
title: CVE-2011-3594 pidgin
description:
The g_markup_escape_text function in the SILC protocol plug-in in libpurple 2.10.0 and earlier, as used in Pidgin and possibly other products, allows remote attackers to cause a denial of service (crash) via invalid UTF-8 sequences that trigger use of invalid pointers and an out-of-bounds read, related to interactions with certain versions of glib2.


definition_id: oval:org.debian:def:31839478422286885662412131401569225938
title: CVE-2011-3596 polipo
description:
Polipo before 1.0.4.1 suffers from a DoD vulnerability via specially-crafted HTTP POST / PUT request.


definition_id: oval:org.debian:def:253018266993065951665675236683095475319
title: CVE-2011-3597 perl
description:
Eval injection vulnerability in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor.


definition_id: oval:org.debian:def:159710953408967598155884793409322522428
title: CVE-2011-3598 phppgadmin
description:
Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title, related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.


definition_id: oval:org.debian:def:127932133325902544579981983460921057950
title: CVE-2011-3599 libcrypt-dsa-perl
description:
The Crypt::DSA (aka Crypt-DSA) module 1.17 and earlier for Perl, when /dev/random is absent, uses the Data::Random module, which makes it easier for remote attackers to spoof a signature, or determine the signing key of a signed message, via a brute-force attack.


definition_id: oval:org.debian:def:211396395406040785210981043426509412612
title: CVE-2011-3600 libxmlrpc3-java
description:
The /webtools/control/xmlrpc endpoint in OFBiz XML-RPC event handler is exposed to External Entity Injection by passing DOCTYPE declarations with executable payloads that discloses the contents of files in the filesystem. In addition, it can also be used to probe for open network ports, and figure out from returned error messages whether a file exists or not. This affects OFBiz 16.11.01 to 16.11.04.


definition_id: oval:org.debian:def:280301195864583983278608241863862273220
title: CVE-2011-3601 radvd
description:
Buffer overflow in the process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative value in a label_len value.


definition_id: oval:org.debian:def:210850566573302813397227277068895989031
title: CVE-2011-3602 radvd
description:
Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name.  NOTE: this can be leveraged with a symlink to overwrite arbitrary files.


definition_id: oval:org.debian:def:303011777437608631456107794456014012293
title: CVE-2011-3604 radvd
description:
The process_ra function in the router advertisement daemon (radvd) before 1.8.2 allows remote attackers to cause a denial of service (stack-based buffer over-read and crash) via unspecified vectors.


definition_id: oval:org.debian:def:34718571503126265826889958982112040892
title: CVE-2011-3605 radvd
description:
The process_rs function in the router advertisement daemon (radvd) before 1.8.2, when UnicastOnly is enabled, allows remote attackers to cause a denial of service (temporary service hang) via a large number of ND_ROUTER_SOLICIT requests.


definition_id: oval:org.debian:def:176422197156792427876251623512086207935
title: CVE-2011-3607 apache2
description:
Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:12420320906548666342479723989391067741
title: CVE-2011-3616 conky
description:
The getSkillname function in the eve module in Conky 1.8.1 and earlier allows local users to overwrite arbitrary files via a symlink attack on /tmp/.cesf.


definition_id: oval:org.debian:def:253766452086840976754159857675380399382
title: CVE-2011-3617 tahoe-lafs
description:
Tahoe-LAFS v1.3.0 through v1.8.2 could allow unauthorized users to delete immutable files in some cases.


definition_id: oval:org.debian:def:314370481447564904384309228201601371658
title: CVE-2011-3623 vlc
description:
Multiple stack-based buffer overflows in VideoLAN VLC media player before 1.0.2 allow remote attackers to execute arbitrary code via (1) a crafted ASF file, related to the ASF_ObjectDumpDebug function in modules/demux/asf/libasf.c; (2) a crafted AVI file, related to the AVI_ChunkDumpDebug_level function in modules/demux/avi/libavi.c; or (3) a crafted MP4 file, related to the __MP4_BoxDumpStructure function in modules/demux/mp4/libmp4.c.


definition_id: oval:org.debian:def:330660927376059717523826210052321056068
title: CVE-2011-3625 mplayer
description:
Stack-based buffer overflow in the sub_read_line_sami function in subreader.c in MPlayer, as used in SMPlayer 0.6.9, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a SAMI subtitle file.


definition_id: oval:org.debian:def:48868389419779982454353542288764359363
title: CVE-2011-3627 clamav
description:
The bytecode engine in ClamAV before 0.97.3 allows remote attackers to cause a denial of service (crash) via vectors related to "recursion level" and (1) libclamav/bytecode.c and (2) libclamav/bytecode_api.c.


definition_id: oval:org.debian:def:198445024708893003225202550086702602126
title: CVE-2011-3628 pam
description:
Untrusted search path vulnerability in pam_motd (aka the MOTD module) in libpam-modules before 1.1.3-2ubuntu2.1 on Ubuntu 11.10, before 1.1.2-2ubuntu8.4 on Ubuntu 11.04, before 1.1.1-4ubuntu2.4 on Ubuntu 10.10, before 1.1.1-2ubuntu5.4 on Ubuntu 10.04 LTS, and before 0.99.7.1-5ubuntu6.5 on Ubuntu 8.04 LTS, when using certain configurations such as "session optional pam_motd.so", allows local users to gain privileges by modifying the PATH environment variable to reference a malicious command, as demonstrated via uname.


definition_id: oval:org.debian:def:210602102267676042878542030827852182791
title: CVE-2011-3634 apt
description:
methods/https.cc in apt before 0.8.11 accepts connections when the certificate host name fails validation and Verify-Host is enabled, which allows man-in-the-middle attackers to obtain repository credentials via unspecified vectors.


definition_id: oval:org.debian:def:63150482947010950700211624156001634888
title: CVE-2011-3635 empathy
description:
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).


definition_id: oval:org.debian:def:320524822991355521158397856871082880640
title: CVE-2011-3639 apache2
description:
The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers by using the HTTP/0.9 protocol with a malformed URI containing an initial @ (at sign) character.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.


definition_id: oval:org.debian:def:25509610819101235126291775100618748145
title: CVE-2011-3640 nss
description:
** DISPUTED ** Untrusted search path vulnerability in Mozilla Network Security Services (NSS), as used in Google Chrome before 17 on Windows and Mac OS X, might allow local users to gain privileges via a Trojan horse pkcs11.txt file in a top-level directory.  NOTE: the vendor's response was "Strange behavior, but we're not treating this as a security bug."


definition_id: oval:org.debian:def:167383458868041211260447362412169765516
title: CVE-2011-3848 puppet
description:
Directory traversal vulnerability in Puppet 2.6.x before 2.6.10 and 2.7.x before 2.7.4 allows remote attackers to write X.509 Certificate Signing Request (CSR) to arbitrary locations via (1) a double-encoded key parameter in the URI in 2.7.x, (2) the CN in the Subject of a CSR in 2.6 and 0.25.


definition_id: oval:org.debian:def:122076213903711415694752986844849819015
title: CVE-2011-3869 puppet
description:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to overwrite arbitrary files via a symlink attack on the .k5login file.


definition_id: oval:org.debian:def:271665023086838754311342911339853623576
title: CVE-2011-3870 puppet
description:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x allows local users to modify the permissions of arbitrary files via a symlink attack on the SSH authorized_keys file.


definition_id: oval:org.debian:def:233271697358839248624473838619857931371
title: CVE-2011-3871 puppet
description:
Puppet 2.7.x before 2.7.5, 2.6.x before 2.6.11, and 0.25.x, when running in --edit mode, uses a predictable file name, which allows local users to run arbitrary Puppet code or trick a user into editing arbitrary files.


definition_id: oval:org.debian:def:165669168562322227781180165444106750028
title: CVE-2011-3872 puppet
description:
Puppet 2.6.x before 2.6.12 and 2.7.x before 2.7.6, and Puppet Enterprise (PE) Users 1.0, 1.1, and 1.2 before 1.2.4, when signing an agent certificate, adds the Puppet master's certdnsnames values to the X.509 Subject Alternative Name field of the certificate, which allows remote attackers to spoof a Puppet master via a man-in-the-middle (MITM) attack against an agent that uses an alternate DNS name for the master, aka "AltNames Vulnerability."


definition_id: oval:org.debian:def:309197358055636610531464714959815961936
title: CVE-2011-3892 ffmpeg
description:
Double free vulnerability in the Theora decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.


definition_id: oval:org.debian:def:315550270498640160248388850566323420568
title: CVE-2011-3893 ffmpeg
description:
Google Chrome before 15.0.874.120 does not properly implement the MKV and Vorbis media handlers, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


definition_id: oval:org.debian:def:20352050360532434417119629244858019862
title: CVE-2011-3895 ffmpeg
description:
Heap-based buffer overflow in the Vorbis decoder in Google Chrome before 15.0.874.120 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted stream.


definition_id: oval:org.debian:def:256813017283088267743158400503089292872
title: CVE-2011-3905 libxml2
description:
libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


definition_id: oval:org.debian:def:280375663273157161092368127116215027329
title: CVE-2011-3919 libxml2
description:
Heap-based buffer overflow in libxml2, as used in Google Chrome before 16.0.912.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:320143619947389444116348735405796294844
title: CVE-2011-3929 ffmpeg
description:
The avpriv_dv_produce_packet function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) and possibly execute arbitrary code via a crafted DV file.


definition_id: oval:org.debian:def:271674365333626649766855534988970455946
title: CVE-2011-3934 ffmpeg
description:
Double free vulnerability in the vp3_update_thread_context function in libavcodec/vp3.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted vp3 data.


definition_id: oval:org.debian:def:132300956270679928261954950075491856738
title: CVE-2011-3936 ffmpeg
description:
The dv_extract_audio function in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted DV file.


definition_id: oval:org.debian:def:83616544309323804188523001399278352361
title: CVE-2011-3940 ffmpeg
description:
nsvdec.c in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (out-of-bounds read and write) via a crafted NSV file that triggers "use of uninitialized streams."


definition_id: oval:org.debian:def:121230588286534322313583334395522115962
title: CVE-2011-3941 ffmpeg
description:
The decode_mb function in libavcodec/error_resilience.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via vectors related to an uninitialized block index, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:60300589260288779433552051949907680819
title: CVE-2011-3944 ffmpeg
description:
The smacker_decode_header_tree function in libavcodec/smacker.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Smacker data.


definition_id: oval:org.debian:def:39208233834593253067338732540771457969
title: CVE-2011-3946 ffmpeg
description:
The ff_h264_decode_sei function in libavcodec/h264_sei.c in FFmpeg before 0.10 allows remote attackers to have an unspecified impact via crafted Supplemental enhancement information (SEI) data, which triggers an infinite loop.


definition_id: oval:org.debian:def:169634697364665555427902008567555315682
title: CVE-2011-3947 ffmpeg
description:
Buffer overflow in mjpegbdec.c in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MJPEG-B file.


definition_id: oval:org.debian:def:294220005325425935056482627923701100052
title: CVE-2011-3951 ffmpeg
description:
The dpcm_decode_frame function in dpcm.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted stereo stream in a media file.


definition_id: oval:org.debian:def:329550744433944751361599737173170622445
title: CVE-2011-3952 ffmpeg
description:
The decode_init function in kmvc.c in libavcodec in FFmpeg before 0.10 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large palette size in a KMVC encoded file.


definition_id: oval:org.debian:def:113588719878825579574316857992360799081
title: CVE-2011-3970 libxslt
description:
libxslt, as used in Google Chrome before 17.0.963.46, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.


definition_id: oval:org.debian:def:26260801352822981657785146610431027852
title: CVE-2011-3973 ffmpeg
description:
cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, related to the decode_residual_block, check_for_slice, and cavs_decode_frame functions, a different vulnerability than CVE-2011-3362.


definition_id: oval:org.debian:def:128731266097185875508324795990459433954
title: CVE-2011-3974 ffmpeg
description:
Integer signedness error in the decode_residual_inter function in cavsdec.c in libavcodec in FFmpeg before 0.7.4 and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (incorrect write operation and application crash) via an invalid bitstream in a Chinese AVS video (aka CAVS) file, a different vulnerability than CVE-2011-3362.


definition_id: oval:org.debian:def:292384477147825745180583801750724029948
title: CVE-2011-4000 chasen
description:
Buffer overflow in ChaSen 2.4.x allows remote attackers to execute arbitrary code via a crafted string.


definition_id: oval:org.debian:def:231605048648163146759268605679742686993
title: CVE-2011-4024 ocsinventory-server
description:
Cross-site scripting (XSS) vulnerability in ocsinventory in OCS Inventory NG 2.0.1 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:317925362841284563152699658585074656179
title: CVE-2011-4028 xorg-server
description:
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to determine the existence of arbitrary files via a symlink attack on a temporary lock file, which is handled differently if the file exists.


definition_id: oval:org.debian:def:255844533595220728580046889766394148286
title: CVE-2011-4029 xorg-server
description:
The LockServer function in os/utils.c in X.Org xserver before 1.11.2 allows local users to change the permissions of arbitrary files to 444, read those files, and possibly cause a denial of service (removed execution permission) via a symlink attack on a temporary lock file.


definition_id: oval:org.debian:def:25396470190285948442067991707691836844
title: CVE-2011-4062 kfreebsd-10
description:
Buffer overflow in the kernel in FreeBSD 7.3 through 9.0-RC1 allows local users to cause a denial of service (panic) or possibly gain privileges via a bind system call with a long pathname for a UNIX socket.


definition_id: oval:org.debian:def:208860904222215359015189360062933242134
title: CVE-2011-4063 asterisk
description:
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.7.1 and 10.x before 10.0.0-rc1 does not properly initialize variables during request parsing, which allows remote authenticated users to cause a denial of service (daemon crash) via a malformed request.


definition_id: oval:org.debian:def:327887874867690355463954067822982649605
title: CVE-2011-4076 nova
description:
OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.


definition_id: oval:org.debian:def:140733772043006284459710307340038808845
title: CVE-2011-4078 roundcube
description:
include/iniset.php in Roundcube Webmail 0.5.4 and earlier, when PHP 5.3.7 or 5.3.8 is used, allows remote attackers to trigger a GET request for an arbitrary URL, and cause a denial of service (resource consumption and inbox outage), via a Subject header containing only a URL, a related issue to CVE-2011-3379.


definition_id: oval:org.debian:def:304294584792684664355727838459174200164
title: CVE-2011-4079 openldap
description:
Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry.


definition_id: oval:org.debian:def:12594515111140494838851592599036040179
title: CVE-2011-4089 bzip2
description:
The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle temporary files during extraction, which allows local users to execute arbitrary code by precreating a temporary directory.


definition_id: oval:org.debian:def:96843179629791160638637912903734795335
title: CVE-2011-4098 linux
description:
The fallocate implementation in the GFS2 filesystem in the Linux kernel before 3.2 relies on the page cache, which might allow local users to cause a denial of service by preallocating blocks in certain situations involving insufficient memory.


definition_id: oval:org.debian:def:87406060337372298951373717480837703934
title: CVE-2011-4099 libcap2
description:
The capsh program in libcap before 2.22 does not change the current working directory when the --chroot option is specified, which allows local users to bypass the chroot restrictions via unspecified vectors.


definition_id: oval:org.debian:def:38755797881637294653228488157119188414
title: CVE-2011-4100 wireshark
description:
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.3 does not initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:122879201273934053371628959027478987821
title: CVE-2011-4101 wireshark
description:
The dissect_infiniband_common function in epan/dissectors/packet-infiniband.c in the Infiniband dissector in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.


definition_id: oval:org.debian:def:26288162886104400938579778848718565645
title: CVE-2011-4102 wireshark
description:
Heap-based buffer overflow in the erf_read_header function in wiretap/erf.c in the ERF file parser in Wireshark 1.4.0 through 1.4.9 and 1.6.x before 1.6.3 allows remote attackers to cause a denial of service (application crash) via a malformed file.


definition_id: oval:org.debian:def:283427112796593317110246568479405363013
title: CVE-2011-4104 django-tastypie
description:
The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.


definition_id: oval:org.debian:def:199597119703000619369598106326790785334
title: CVE-2011-4105 lightdm
description:
LightDM before 1.0.6 allows local users to change ownership of arbitrary files via a symlink attack on ~/.Xauthority.


definition_id: oval:org.debian:def:273701085625640255492236203057640839443
title: CVE-2011-4108 openssl
description:
The DTLS implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f performs a MAC check only if certain padding is valid, which makes it easier for remote attackers to recover plaintext via a padding oracle attack.


definition_id: oval:org.debian:def:62621669100354774242594397012650133994
title: CVE-2011-4109 openssl
description:
Double free vulnerability in OpenSSL 0.9.8 before 0.9.8s, when X509_V_FLAG_POLICY_CHECK is enabled, allows remote attackers to have an unspecified impact by triggering failure of a policy check.


definition_id: oval:org.debian:def:132632701364990046054544753834206556914
title: CVE-2011-4111 qemu
description:
Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.


definition_id: oval:org.debian:def:84730521037958963843371195221700955195
title: CVE-2011-4114 libpar-packer-perl
description:
The par_mktmpdir function in the PAR::Packer module before 1.012 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program.  NOTE: a similar vulnerability was reported for PAR, but this has been assigned a different CVE identifier.


definition_id: oval:org.debian:def:33484933290154034836354033632536206169
title: CVE-2011-4120 yubico-pam
description:
Yubico PAM Module before 2.10 performed user authentication when 'use_first_pass' PAM configuration option was not used and the module was configured as 'sufficient' in the PAM configuration. A remote attacker could use this flaw to circumvent common authentication process and obtain access to the account in question by providing a NULL value (pressing Ctrl-D keyboard sequence) as the password string.


definition_id: oval:org.debian:def:27773267682894713840596665679311759392
title: CVE-2011-4124 calibre
description:
Input validation issues were found in Calibre at devices/linux_mount_helper.c which can lead to argument injection and elevation of privileges.


definition_id: oval:org.debian:def:321939253972604226640846589714690854255
title: CVE-2011-4125 calibre
description:
A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root.


definition_id: oval:org.debian:def:62385913700548707815313285597056129611
title: CVE-2011-4126 calibre
description:
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.


definition_id: oval:org.debian:def:107058526091328756422971815227651430930
title: CVE-2011-4130 proftpd-dfsg
description:
Use-after-free vulnerability in the Response API in ProFTPD before 1.3.3g allows remote authenticated users to execute arbitrary code via vectors involving an error that occurs after an FTP data transfer.


definition_id: oval:org.debian:def:215336758030450750007629830870507460475
title: CVE-2011-4131 linux
description:
The NFSv4 implementation in the Linux kernel before 3.2.2 does not properly handle bitmap sizes in GETACL replies, which allows remote NFS servers to cause a denial of service (OOPS) by sending an excessive number of bitmap words.


definition_id: oval:org.debian:def:136219944506336332938639693177468034820
title: CVE-2011-4136 python-django
description:
django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.


definition_id: oval:org.debian:def:220023048915052683082743223040758577399
title: CVE-2011-4137 python-django
description:
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.


definition_id: oval:org.debian:def:221300840125521539085654710096685778737
title: CVE-2011-4138 python-django
description:
The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.


definition_id: oval:org.debian:def:71626386227533054091410282139809107783
title: CVE-2011-4139 python-django
description:
Django before 1.2.7 and 1.3.x before 1.3.1 uses a request's HTTP Host header to construct a full URL in certain circumstances, which allows remote attackers to conduct cache poisoning attacks via a crafted request.


definition_id: oval:org.debian:def:50995975727914139064842413124287354094
title: CVE-2011-4140 python-django
description:
The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.


definition_id: oval:org.debian:def:274989744927304392906444234767184880880
title: CVE-2011-4151 krb5
description:
The krb5_db2_lockout_audit function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4, when the db2 (aka Berkeley DB) back end is used, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors, a different vulnerability than CVE-2011-1528.


definition_id: oval:org.debian:def:60924574447443895885908405561909308934
title: CVE-2011-4170 empathy
description:
Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname) in a /me event, a different vulnerability than CVE-2011-3635.


definition_id: oval:org.debian:def:293097221587911152956067476030148754391
title: CVE-2011-4313 bind9
description:
query.c in ISC BIND 9.0.x through 9.6.x, 9.4-ESV through 9.4-ESV-R5, 9.6-ESV through 9.6-ESV-R5, 9.7.0 through 9.7.4, 9.8.0 through 9.8.1, and 9.9.0a1 through 9.9.0b1 allows remote attackers to cause a denial of service (assertion failure and named exit) via unknown vectors related to recursive DNS queries, error logging, and the caching of an invalid record by the resolver.


definition_id: oval:org.debian:def:54354677410804824951900770669406416553
title: CVE-2011-4314 openid4java
description:
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.


definition_id: oval:org.debian:def:82330184988686200740931023873282111250
title: CVE-2011-4315 nginx
description:
Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.


definition_id: oval:org.debian:def:8719466978832947360819150216141445803
title: CVE-2011-4317 apache2
description:
The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an @ (at sign) character and a : (colon) character in invalid positions.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3368.


definition_id: oval:org.debian:def:315699502659516875070773213519419173730
title: CVE-2011-4318 dovecot
description:
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.


definition_id: oval:org.debian:def:309798451639978911418907520311306485432
title: CVE-2011-4320 ejabberd
description:
The mod_pubsub module (mod_pubsub.erl) in ejabberd 2.1.8 and 3.0.0-alpha-3 allows remote authenticated users to cause a denial of service (infinite loop) via a stanza with a publish tag that lacks a node attribute.


definition_id: oval:org.debian:def:141241553403838860804493027090461541550
title: CVE-2011-4339 ipmitool
description:
ipmievd (aka the IPMI event daemon) in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux (RHEL) 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this file.


definition_id: oval:org.debian:def:105855108153855682926370029507154139884
title: CVE-2011-4345 namazu2
description:
Cross-site scripting (XSS) vulnerability in Namazu before 2.0.21, when Internet Explorer 6 or 7 is used, allows remote attackers to inject arbitrary web script or HTML via a cookie.


definition_id: oval:org.debian:def:141455887701756340985286631148715159895
title: CVE-2011-4349 colord
description:
Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.


definition_id: oval:org.debian:def:266194807882460142300396502385888588844
title: CVE-2011-4350 yaws
description:
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed. A remote authenticated user could use this flaw to obtain content of arbitrary local files via specially-crafted URL request.


definition_id: oval:org.debian:def:154192454837928880936457995585729626883
title: CVE-2011-4351 ffmpeg
description:
Buffer overflow in FFmpeg before 0.5.6, 0.6.x before 0.6.4, 0.7.x before 0.7.8, and 0.8.x before 0.8.8 allows remote attackers to execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:160040334140588304596003000371740063885
title: CVE-2011-4353 ffmpeg
description:
The (1) av_image_fill_pointers, (2) vp5_parse_coeff, and (3) vp6_parse_coeff functions in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allow remote attackers to cause a denial of service (out-of-bounds read) via a crafted VP5 or VP6 stream.


definition_id: oval:org.debian:def:19781675178475089698707311242636491717
title: CVE-2011-4354 openssl
description:
crypto/bn/bn_nist.c in OpenSSL before 0.9.8h on 32-bit platforms, as used in stunnel and other products, in certain circumstances involving ECDH or ECDHE cipher suites, uses an incorrect modular reduction algorithm in its implementation of the P-256 and P-384 NIST elliptic curves, which allows remote attackers to obtain the private key of a TLS server via multiple handshake attempts.


definition_id: oval:org.debian:def:258091778350077229213501028730336622222
title: CVE-2011-4356 celery
description:
Celery 2.1 and 2.2 before 2.2.8, 2.3 before 2.3.4, and 2.4 before 2.4.4 changes the effective id but not the real id during processing of the --uid and --gid arguments to celerybeat, celeryd_detach, celeryd-multi, and celeryev, which allows local users to gain privileges via vectors involving crafted code that is executed by the worker process.


definition_id: oval:org.debian:def:306579741069305051597494956286326350423
title: CVE-2011-4357 clearsilver
description:
Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.


definition_id: oval:org.debian:def:23570297743832626653714847172584992757
title: CVE-2011-4358 mojarra
description:
Unspecified vulnerability in Oracle GlassFish Enterprise Server 3.0.1 and 3.1.1 allows remote attackers to affect confidentiality and integrity, related to JSF.


definition_id: oval:org.debian:def:99422248119460316886231785582014844702
title: CVE-2011-4360 mediawiki
description:
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.


definition_id: oval:org.debian:def:39261699216471090326484361548301521159
title: CVE-2011-4361 mediawiki
description:
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.


definition_id: oval:org.debian:def:242483031460335967481344473203368327319
title: CVE-2011-4362 lighttpd
description:
Integer signedness error in the base64_decode function in the HTTP authentication functionality (http_auth.c) in lighttpd 1.4 before 1.4.30 and 1.5 before SVN revision 2806 allows remote attackers to cause a denial of service (segmentation fault) via crafted base64 input that triggers an out-of-bounds read with a negative index.


definition_id: oval:org.debian:def:161488147593319247421490017143735358701
title: CVE-2011-4363 libproc-processtable-perl
description:
ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when TTY information caching is enabled, allows local users to overwrite arbitrary files via a symlink attack on /tmp/TTYDEVS.


definition_id: oval:org.debian:def:276362140614385011358735529277376507016
title: CVE-2011-4364 ffmpeg
description:
Buffer overflow in the Sierra VMD decoder in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9 and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VMD file, related to corrupted streams.


definition_id: oval:org.debian:def:101522291635715641963078033090651750428
title: CVE-2011-4405 system-config-printer
description:
The cupshelpers scripts in system-config-printer in Ubuntu 11.04 and 11.10, as used by the automatic printer driver download service, uses an "insecure connection" for queries to the OpenPrinting database, which allows remote attackers to execute arbitrary code via a man-in-the-middle (MITM) attack that modifies packages or repositories.


definition_id: oval:org.debian:def:26149405887076396432549662114299751164
title: CVE-2011-4406 accountsservice
description:
The Ubuntu AccountsService package before 0.6.14-1git1ubuntu1.1 does not properly drop privileges when changing language settings, which allows local users to modify arbitrary files via unspecified vectors.


definition_id: oval:org.debian:def:30115065888761636838432036138684364966
title: CVE-2011-4407 software-properties
description:
ppa.py in Software Properties before 0.81.13.3 does not validate the server certificate when downloading PPA GPG key fingerprints, which allows man-in-the-middle (MITM) attackers to spoof GPG keys for a package repository.


definition_id: oval:org.debian:def:218507562629496471788437092160283710727
title: CVE-2011-4415 apache2
description:
The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, does not restrict the size of values of environment variables, which allows local users to cause a denial of service (memory consumption or NULL pointer dereference) via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, related to (1) the "len +=" statement and (2) the apr_pcalloc function call, a different vulnerability than CVE-2011-3607.


definition_id: oval:org.debian:def:121889234658896264017525078389399134196
title: CVE-2011-4458 request-tracker4
description:
Best Practical Solutions RT 3.6.x, 3.7.x, and 3.8.x before 3.8.12 and 4.x before 4.0.6, when the VERPPrefix and VERPDomain options are enabled, allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2011-5092 and CVE-2011-5093.


definition_id: oval:org.debian:def:35615991761272480870039352688333556506
title: CVE-2011-4459 request-tracker4
description:
Best Practical Solutions RT 3.x before 3.8.12 and 4.x before 4.0.6 does not properly disable groups, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging a group membership.


definition_id: oval:org.debian:def:239435220158890892335239348940461287111
title: CVE-2011-4460 request-tracker4
description:
SQL injection vulnerability in Best Practical Solutions RT 2.x and 3.x before 3.8.12 and 4.x before 4.0.6 allows remote authenticated users to execute arbitrary SQL commands by leveraging access to a privileged account.


definition_id: oval:org.debian:def:31472413264492069042841328756010012475
title: CVE-2011-4516 ghostscript
description:
Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.


definition_id: oval:org.debian:def:326982638459634765004611123238071709495
title: CVE-2011-4517 ghostscript
description:
The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.


definition_id: oval:org.debian:def:280495940059726865614497439102913303783
title: CVE-2011-4528 unbound
description:
Unbound before 1.4.13p2 attempts to free unallocated memory during processing of duplicate CNAME records in a signed zone, which allows remote DNS servers to cause a denial of service (daemon crash) via a crafted response.


definition_id: oval:org.debian:def:135122283862679110014731373418599461145
title: CVE-2011-4539 isc-dhcp
description:
dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.


definition_id: oval:org.debian:def:251280492441342698234512409085949153430
title: CVE-2011-4576 openssl
description:
The SSL 3.0 implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly initialize data structures for block cipher padding, which might allow remote attackers to obtain sensitive information by decrypting the padding data sent by an SSL peer.


definition_id: oval:org.debian:def:79523949951298865847180715262345231291
title: CVE-2011-4577 openssl
description:
OpenSSL before 0.9.8s and 1.x before 1.0.0f, when RFC 3779 support is enabled, allows remote attackers to cause a denial of service (assertion failure) via an X.509 certificate containing certificate-extension data associated with (1) IP address blocks or (2) Autonomous System (AS) identifiers.


definition_id: oval:org.debian:def:143543780941786719282152726328103953509
title: CVE-2011-4578 acpid
description:
event.c in acpid (aka acpid2) before 2.0.11 does not have an appropriate umask setting during execution of event-handler scripts, which might allow local users to (1) perform write operations within directories created by a script, or (2) read files created by a script, via standard filesystem system calls.


definition_id: oval:org.debian:def:216671259469076477725715024201097381592
title: CVE-2011-4579 ffmpeg
description:
The svq1_decode_frame function in the SVQ1 decoder (svq1dec.c) in libavcodec in FFmpeg 0.5.x before 0.5.7, 0.6.x before 0.6.4, 0.7.x before 0.7.9, and 0.8.x before 0.8.8; and in Libav 0.5.x before 0.5.6, 0.6.x before 0.6.4, and 0.7.x before 0.7.3 allows remote attackers to cause a denial of service (memory corruption) via a crafted SVQ1 stream, related to "dimensions changed."


definition_id: oval:org.debian:def:177333884277683380616085059416548821365
title: CVE-2011-4596 nova
description:
Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.


definition_id: oval:org.debian:def:54139054488560137764328199666347185811
title: CVE-2011-4597 asterisk
description:
The SIP over UDP implementation in Asterisk Open Source 1.4.x before 1.4.43, 1.6.x before 1.6.2.21, and 1.8.x before 1.8.7.2 uses different port numbers for responses to invalid requests depending on whether a SIP username exists, which allows remote attackers to enumerate usernames via a series of requests.


definition_id: oval:org.debian:def:307697304074263383111977902083640705692
title: CVE-2011-4598 asterisk
description:
The handle_request_info function in channels/chan_sip.c in Asterisk Open Source 1.6.2.x before 1.6.2.21 and 1.8.x before 1.8.7.2, when automon is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted sequence of SIP requests.


definition_id: oval:org.debian:def:279139294752279510362057651428832729857
title: CVE-2011-4600 libvirt
description:
The networkReloadIptablesRules function in network/bridge_driver.c in libvirt before 0.9.9 does not properly handle firewall rules on bridge networks when libvirtd is restarted, which might allow remote attackers to bypass intended access restrictions via a (1) DNS or (2) DHCP query.


definition_id: oval:org.debian:def:251274456121067935541860858920209683176
title: CVE-2011-4601 pidgin
description:
family_feedbag.c in the oscar protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted (1) AIM or (2) ICQ message associated with buddy-list addition.


definition_id: oval:org.debian:def:155103228751557783313194426896424163231
title: CVE-2011-4602 pidgin
description:
The XMPP protocol plugin in libpurple in Pidgin before 2.10.1 does not properly handle missing fields in (1) voice-chat and (2) video-chat stanzas, which allows remote attackers to cause a denial of service (application crash) via a crafted message.


definition_id: oval:org.debian:def:184369624685037347708924581760677227047
title: CVE-2011-4603 pidgin
description:
The silc_channel_message function in ops.c in the SILC protocol plugin in libpurple in Pidgin before 2.10.1 does not perform the expected UTF-8 validation on message data, which allows remote attackers to cause a denial of service (application crash) via a crafted message, a different vulnerability than CVE-2011-3594.


definition_id: oval:org.debian:def:124442482951634530555635853015344460779
title: CVE-2011-4606 rocksndiamonds
description:
Artsoft Entertainment Rocks'n'Diamonds (aka rocksndiamonds) 3.3.0.1 allows local users to overwrite arbitrary files via a symlink attack on .rocksndiamonds/cache/artworkinfo.cache under a user's home directory.


definition_id: oval:org.debian:def:277977928622269539744385393058459601005
title: CVE-2011-4607 putty
description:
PuTTY 0.59 through 0.61 does not clear sensitive process memory when managing user replies that occur during keyboard-interactive authentication, which might allow local users to read login passwords by obtaining access to the process' memory.


definition_id: oval:org.debian:def:192469598431394774241968749443801470040
title: CVE-2011-4612 icecast2
description:
icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.


definition_id: oval:org.debian:def:139124209191261706866140011528778618961
title: CVE-2011-4613 xorg
description:
The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY.


definition_id: oval:org.debian:def:259114152471325239602583453416061884292
title: CVE-2011-4615 zabbix
description:
Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php, the update action to (3) hosts.php and (4) scripts.php, and (5) maintenance.php.


definition_id: oval:org.debian:def:70824975802616513827191186478978803250
title: CVE-2011-4616 libhtml-template-pro-perl
description:
Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary web script or HTML via template parameters, related to improper handling of > (greater than) and < (less than) characters.


definition_id: oval:org.debian:def:140747632798666890758722529927133833558
title: CVE-2011-4617 python-virtualenv
description:
virtualenv.py in virtualenv before 1.5 allows local users to overwrite arbitrary files via a symlink attack on a certain file in /tmp/.


definition_id: oval:org.debian:def:335552083912743378302321800424588679644
title: CVE-2011-4619 openssl
description:
The Server Gated Cryptography (SGC) implementation in OpenSSL before 0.9.8s and 1.x before 1.0.0f does not properly handle handshake restarts, which allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.


definition_id: oval:org.debian:def:128957159920222377051102266203312277635
title: CVE-2011-4620 plib
description:
Buffer overflow in the ulSetError function in util/ulError.cxx in PLIB 1.8.5, as used in TORCS 1.3.1 and other products, allows user-assisted remote attackers to execute arbitrary code via vectors involving a long error message, as demonstrated by a crafted acc file for TORCS. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:86436611925148523468308937012477705721
title: CVE-2011-4623 rsyslog
description:
Integer overflow in the rsCStrExtendBuf function in runtime/stringbuf.c in the imfile module in rsyslog 4.x before 4.6.6, 5.x before 5.7.4, and 6.x before 6.1.4 allows local users to cause a denial of service (daemon hang) via a large file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:22337501567655085923890895657915471686
title: CVE-2011-4625 simplesamlphp
description:
simplesamlphp before 1.6.3 (squeeze) and before 1.8.2 (sid) incorrectly handles XML encryption which could allow remote attackers to decrypt or forge messages.


definition_id: oval:org.debian:def:218603849343074436898201875471509130435
title: CVE-2011-4674 zabbix
description:
SQL injection vulnerability in popup.php in Zabbix 1.8.3 and 1.8.4, and possibly other versions before 1.8.9, allows remote attackers to execute arbitrary SQL commands via the only_hostid parameter.


definition_id: oval:org.debian:def:152540242949235772197925640977658862628
title: CVE-2011-4675 widelands
description:
The pathname canonicalization functionality in io/filesystem/filesystem.cc in Widelands before 15.1 expands leading ~ (tilde) characters to home-directory pathnames but does not restrict use of these characters in strings received from the network, which might allow remote attackers to conduct absolute path traversal attacks and overwrite arbitrary files via a ~ in a pathname that is used for a file transfer in an Internet game, a different vulnerability than CVE-2011-1932.


definition_id: oval:org.debian:def:64032602582414231040422569591957091980
title: CVE-2011-4824 cacti
description:
SQL injection vulnerability in auth_login.php in Cacti before 0.8.7h allows remote attackers to execute arbitrary SQL commands via the login_username parameter.


definition_id: oval:org.debian:def:169649191302650829636952874649218385203
title: CVE-2011-4838 jruby
description:
JRuby before 1.6.5.1 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.


definition_id: oval:org.debian:def:152653848505890672654913400271489137807
title: CVE-2011-4862 heimdal
description:
Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long encryption key, as exploited in the wild in December 2011.


definition_id: oval:org.debian:def:121876327132682584092325724484181278905
title: CVE-2011-4868 isc-dhcp
description:
The logging functionality in dhcpd in ISC DHCP before 4.2.3-P2, when using Dynamic DNS (DDNS) and issuing IPv6 addresses, does not properly handle the DHCPv6 lease structure, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets related to a lease-status update.


definition_id: oval:org.debian:def:43227779586616356258249997100797942657
title: CVE-2011-4869 unbound
description:
validator/val_nsec3.c in Unbound before 1.4.13p2 does not properly perform proof processing for NSEC3-signed zones, which allows remote DNS servers to cause a denial of service (daemon crash) via a malformed response that lacks expected NSEC3 records, a different vulnerability than CVE-2011-4528.


definition_id: oval:org.debian:def:148410122923076456130590753709461257700
title: CVE-2011-4894 tor
description:
Tor before 0.2.2.34, when configured as a bridge, uses direct DirPort access instead of a Tor TLS connection for a directory fetch, which makes it easier for remote attackers to enumerate bridges by observing DirPort connections.


definition_id: oval:org.debian:def:243450150520220751686817329323984647680
title: CVE-2011-4895 tor
description:
Tor before 0.2.2.34, when configured as a bridge, sets up circuits through a process different from the process used by a client, which makes it easier for remote attackers to enumerate bridges by observing circuit building.


definition_id: oval:org.debian:def:139009956945550355790941879586221084820
title: CVE-2011-4896 tor
description:
Tor before 0.2.2.24-alpha continues to use a reachable bridge that was previously configured but is not currently configured, which might allow remote attackers to obtain sensitive information about clients in opportunistic circumstances by monitoring network traffic to the bridge port.


definition_id: oval:org.debian:def:201381899590245278601940399128946008983
title: CVE-2011-4897 tor
description:
Tor before 0.2.2.25-alpha, when configured as a relay without the Nickname configuration option, uses the local hostname as the Nickname value, which allows remote attackers to obtain potentially sensitive information by reading this value.


definition_id: oval:org.debian:def:131561666772097158740676758265188130179
title: CVE-2011-4905 activemq
description:
Apache ActiveMQ before 5.6.0 allows remote attackers to cause a denial of service (file-descriptor exhaustion and broker crash or hang) by sending many openwire failover:tcp:// connection requests.


definition_id: oval:org.debian:def:57947353779457898822422640976828238406
title: CVE-2011-4922 pidgin
description:
cipher.c in the Cipher API in libpurple in Pidgin before 2.7.10 retains encryption-key data in process memory, which might allow local users to obtain sensitive information by reading a core file or other representation of memory contents.


definition_id: oval:org.debian:def:139114935309633722509754072660811890064
title: CVE-2011-4923 backuppc
description:
Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi, related to the log file viewer, a different vulnerability than CVE-2011-3361.


definition_id: oval:org.debian:def:268692633166537694050630945279636350130
title: CVE-2011-4939 pidgin
description:
The pidgin_conv_chat_rename_user function in gtkconv.c in Pidgin before 2.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by changing a nickname while in an XMPP chat room.


definition_id: oval:org.debian:def:193972041085408172214689670981552523453
title: CVE-2011-4944 python2.7
description:
Python 2.6 through 3.2 creates ~/.pypirc with world-readable permissions before changing them after data has been written, which introduces a race condition that allows local users to obtain a username and password by reading this file.


definition_id: oval:org.debian:def:281968125861281503325456845387453736638
title: CVE-2011-4945 policykit-1
description:
PolicyKit 0.103 sets the AdminIdentities to "wheel" by default, which allows local users in the wheel group to gain root privileges without authentication.


definition_id: oval:org.debian:def:260955686622002558383152707496173018851
title: CVE-2011-4956 wordpress
description:
Cross-site scripting (XSS) vulnerability in WordPress before 3.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:297355082600752914061450423306695088051
title: CVE-2011-4957 wordpress
description:
The make_clickable function in wp-includes/formatting.php in WordPress before 3.1.1 does not properly check URLs before passing them to the PCRE library, which allows remote attackers to cause a denial of service (crash) via a comment with a crafted URL that triggers many recursive calls.


definition_id: oval:org.debian:def:157517572219993417207045522610401470191
title: CVE-2011-4966 freeradius
description:
modules/rlm_unix/rlm_unix.c in FreeRADIUS before 2.2.0, when unix mode is enabled for user authentication, does not properly check the password expiration in /etc/shadow, which allows remote authenticated users to authenticate using an expired password.


definition_id: oval:org.debian:def:25339807650474486515696881046633058064
title: CVE-2011-4968 nginx
description:
nginx http proxy module does not verify peer identity of https origin server which could facilitate man-in-the-middle attack (MITM)


definition_id: oval:org.debian:def:179958652348309708113474417652131943845
title: CVE-2011-4969 jquery
description:
Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.


definition_id: oval:org.debian:def:51070390166738378644918622153789411388
title: CVE-2011-4970 lcgdm
description:
Multiple SQL injection vulnerabilities in LCG Disk Pool Manager (DPM) before 1.8.6, as used in EGI UDM, allow remote attackers to execute arbitrary SQL commands via the (1) r_token variable in the dpm_get_pending_req_by_token, (2) dpm_get_cpr_by_fullid, (3) dpm_get_cpr_by_surl, (4) dpm_get_cpr_by_surls, (5) dpm_get_gfr_by_fullid, (6) dpm_get_gfr_by_surl, (7) dpm_get_pfr_by_fullid, (8) dpm_get_pfr_by_surl, (9) dpm_get_req_by_token, (10) dpm_insert_cpr_entry, (11) dpm_insert_gfr_entry, (12) dpm_insert_pending_entry, (13) dpm_insert_pfr_entry, (14) dpm_insert_xferreq_entry, (15) dpm_list_cpr_entry, (16) dpm_list_gfr_entry, or (17) dpm_list_pfr_entry function; the (18) surl variable in the dpm_get_cpr_by_surl function; the (19) to_surl variable in the dpm_get_cpr_by_surls function; the (20) u_token variable in the dpm_get_pending_reqs_by_u_desc, (21) dpm_get_reqs_by_u_desc, (22) dpm_get_spcmd_by_u_desc, (23) dpm_insert_pending_entry, (24) dpm_insert_spcmd_entry, or (25) dpm_insert_xferreq_entry function; the (26) s_token variable in the dpm_get_spcmd_by_token, (27) dpm_insert_cpr_entry, (28) dpm_insert_gfr_entry, (29) dpm_insert_pfr_entry, (30) dpm_insert_spcmd_entry, (31) dpm_update_cpr_entry, (32) dpm_update_gfr_entry, or (33) dpm_update_pfr_entry function; or remote administrators to execute arbitrary SQL commands via the (34) poolname variable in the dpm_get_pool_entry, (35) dpm_insert_fs_entry, (36) dpm_insert_pool_entry, (37) dpm_insert_spcmd_entry, (38) dpm_list_fs_entry, or (39) dpm_update_spcmd_entry function.


definition_id: oval:org.debian:def:60109743511891532076292364626317548174
title: CVE-2011-4971 memcached
description:
Multiple integer signedness errors in the (1) process_bin_sasl_auth, (2) process_bin_complete_sasl_auth, (3) process_bin_update, and (4) process_bin_append_prepend functions in Memcached 1.4.5 and earlier allow remote attackers to cause a denial of service (crash) via a large body length value in a packet.


definition_id: oval:org.debian:def:174409748566669808795318811690552539697
title: CVE-2011-5000 openssh
description:
The ssh_gssapi_parse_ename function in gss-serv.c in OpenSSH 5.8 and earlier, when gssapi-with-mic authentication is enabled, allows remote authenticated users to cause a denial of service (memory consumption) via a large value in a certain length field.  NOTE: there may be limited scenarios in which this issue is relevant.


definition_id: oval:org.debian:def:79898786687920063160011159270081869213
title: CVE-2011-5025 yaws
description:
Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws, (2) the index parameter to showOldPage.yaws, (3) the node parameter to allRefsToMe.yaws, or (4) the text parameter to editPage.yaws.


definition_id: oval:org.debian:def:301618463075180475632837631698812012863
title: CVE-2011-5027 zabbix
description:
Cross-site scripting (XSS) vulnerability in ZABBIX before 1.8.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the profiler.


definition_id: oval:org.debian:def:106480153483462685672098245843310244277
title: CVE-2011-5036 ruby-rack
description:
Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.


definition_id: oval:org.debian:def:298598309057291563897632616752481659446
title: CVE-2011-5055 maradns
description:
MaraDNS 1.3.07.12 and 1.4.08 computes hash values for DNS data without properly restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set.  NOTE: this issue exists because of an incomplete fix for CVE-2012-0024.


definition_id: oval:org.debian:def:194437107347344901360779121083593667508
title: CVE-2011-5060 libpar-perl
description:
The par_mktmpdir function in the PAR module before 1.003 for Perl creates temporary files in a directory with a predictable name without verifying ownership and permissions of this directory, which allows local users to overwrite files when another user extracts a PAR packed program, a different vulnerability in a different package than CVE-2011-4114.


definition_id: oval:org.debian:def:45247657988354299117379727818039633036
title: CVE-2011-5081 backuppc
description:
Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile action to index.cgi.


definition_id: oval:org.debian:def:67579598031359791417212322069774889675
title: CVE-2011-5095 openssl
description:
The Diffie-Hellman key-exchange implementation in OpenSSL 0.9.8, when FIPS mode is enabled, does not properly validate a public parameter, which makes it easier for man-in-the-middle attackers to obtain the shared secret key by modifying network traffic, a related issue to CVE-2011-1923.


definition_id: oval:org.debian:def:127966622808631696812286233775867932253
title: CVE-2011-5097 chef
description:
chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.


definition_id: oval:org.debian:def:72953977182144657677530962387648055406
title: CVE-2011-5098 chef
description:
chef-server-api/app/controllers/clients.rb in Chef Server in Chef before 0.9.20, and 0.10.x before 0.10.6, does not require administrative privileges for creating admin clients, which allows remote authenticated users to bypass intended access restrictions by leveraging read permission for the validation key and executing a knife client create command with the --admin option.


definition_id: oval:org.debian:def:196678640498038911170687342190840147950
title: CVE-2011-5223 cacti
description:
Cross-site request forgery (CSRF) vulnerability in logout.php in Cacti before 0.8.7i allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


definition_id: oval:org.debian:def:103576125064723606155127935920536643616
title: CVE-2011-5244 evince
description:
Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.


definition_id: oval:org.debian:def:291213147680704852771930437203846516095
title: CVE-2011-5268 bip
description:
connection.c in Bip before 0.8.9 does not properly close sockets, which allows remote attackers to cause a denial of service (file descriptor consumption and crash) via multiple failed SSL handshakes, a different vulnerability than CVE-2013-4550.  NOTE: this issue was SPLIT from CVE-2013-4550 because it is a different type of issue.


definition_id: oval:org.debian:def:88503896858334479672388906301941663677
title: CVE-2011-5270 wordpress
description:
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publish_posts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role.


definition_id: oval:org.debian:def:159999404620933042471732986698470804531
title: CVE-2011-5280 boinc
description:
Multiple stack-based buffer overflows in BOINC 6.13.x allow remote attackers to cause a denial of service (crash) via a long trickle-up to (1) client/cs_trickle.cpp or (2) db/db_base.cpp.


definition_id: oval:org.debian:def:339963155627178621673154353734710574337
title: CVE-2011-5320 glibc
description:
scanf and related functions in glibc before 2.15 allow local users to cause a denial of service (segmentation fault) via a large string of 0s.


definition_id: oval:org.debian:def:113807123798612403055066545423349310366
title: CVE-2011-5321 linux
description:
The tty_open function in drivers/tty/tty_io.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via crafted access to a device file under the /dev/pts directory.


definition_id: oval:org.debian:def:95941692271565146163740175072417222773
title: CVE-2011-5325 busybox
description:
Directory traversal vulnerability in the BusyBox implementation of tar before 1.22.0 v5 allows remote attackers to point to files outside the current working directory via a symlink.


definition_id: oval:org.debian:def:339043810916782454614697993792299355114
title: CVE-2011-5326 imlib2
description:
imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellipse.


definition_id: oval:org.debian:def:324489831614120360810279160933929475778
title: CVE-2012-0021 apache2
description:
The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server 2.2.17 through 2.2.21, when a threaded MPM is used, does not properly handle a %{}C format string, which allows remote attackers to cause a denial of service (daemon crash) via a cookie that lacks both a name and a value.


definition_id: oval:org.debian:def:101800750573189610691692145867427350361
title: CVE-2012-0023 vlc
description:
Double free vulnerability in the get_chunk_header function in modules/demux/ty.c in VideoLAN VLC media player 0.9.0 through 1.1.12 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted TiVo (TY) file.


definition_id: oval:org.debian:def:266193475409400521773987373193441218852
title: CVE-2012-0024 maradns
description:
MaraDNS before 1.3.07.12 and 1.4.x before 1.4.08 computes hash values for DNS data without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted queries with the Recursion Desired (RD) bit set.


definition_id: oval:org.debian:def:139588420348241773449849966563473339527
title: CVE-2012-0027 openssl
description:
The GOST ENGINE in OpenSSL before 1.0.0f does not properly handle invalid parameters for the GOST block cipher, which allows remote attackers to cause a denial of service (daemon crash) via crafted data from a TLS client.


definition_id: oval:org.debian:def:65422036086407744956134681917180563315
title: CVE-2012-0030 nova
description:
Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter.


definition_id: oval:org.debian:def:260772018481018789921144073457186837742
title: CVE-2012-0031 apache2
description:
scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.


definition_id: oval:org.debian:def:130712636499740632320927772504690271204
title: CVE-2012-0033 znc
description:
The CBounceDCCMod::OnPrivCTCP function in bouncedcc.cpp in the bouncedcc module in ZNC 0.200 and 0.202 allows remote attackers to cause a denial of service (crash) via a crafted DCC RESUME request.


definition_id: oval:org.debian:def:122031937221331382619199837005337355567
title: CVE-2012-0036 curl
description:
curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol.


definition_id: oval:org.debian:def:29632653004470424679176137004864962400
title: CVE-2012-0040 simplesamlphp
description:
Cross-site scripting (XSS) vulnerability in modules/core/www/no_cookie.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the retryURL parameter.


definition_id: oval:org.debian:def:139450571330706647959657660913428825033
title: CVE-2012-0041 wireshark
description:
The dissect_packet function in epan/packet.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a capture file, as demonstrated by an airopeek file.


definition_id: oval:org.debian:def:86628448744041340252882745093217645445
title: CVE-2012-0042 wireshark
description:
Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 does not properly perform certain string conversions, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted packet, related to epan/to_str.c.


definition_id: oval:org.debian:def:104207514923106911501978342935226701377
title: CVE-2012-0043 wireshark
description:
Buffer overflow in the reassemble_message function in epan/dissectors/packet-rlc.c in the RLC dissector in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a series of fragmented RLC packets.


definition_id: oval:org.debian:def:294302762951386844126412973996905050587
title: CVE-2012-0049 openttd
description:
OpenTTD before 1.1.5 contains a Denial of Service (slow read attack) that prevents users from joining the server.


definition_id: oval:org.debian:def:285880448778439476103737723822815223414
title: CVE-2012-0050 openssl
description:
OpenSSL 0.9.8s and 1.0.0f does not properly support DTLS applications, which allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an out-of-bounds read.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-4108.


definition_id: oval:org.debian:def:339261380234486966175615793102864644546
title: CVE-2012-0053 apache2
description:
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.


definition_id: oval:org.debian:def:229235260886572893008708051268756092090
title: CVE-2012-0060 rpm
description:
RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.


definition_id: oval:org.debian:def:304880477101987065212445068366698771863
title: CVE-2012-0061 rpm
description:
The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.


definition_id: oval:org.debian:def:145243021620691495603196659563999551172
title: CVE-2012-0064 xorg-server
description:
xkeyboard-config before 2.5 in X.Org before 7.6 enables certain XKB debugging functions by default, which allows physically proximate attackers to bypass an X screen lock via keyboard combinations that break the input grab.


definition_id: oval:org.debian:def:114333197756705526014647079718500390409
title: CVE-2012-0065 usbmuxd
description:
Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.


definition_id: oval:org.debian:def:183505464167321721243406492558822835567
title: CVE-2012-0066 wireshark
description:
Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a long packet in a (1) Accellent 5Views (aka .5vw) file, (2) I4B trace file, or (3) NETMON 2 capture file.


definition_id: oval:org.debian:def:238153468740912577687146424108009059076
title: CVE-2012-0068 wireshark
description:
The lanalyzer_read function in wiretap/lanalyzer.c in Wireshark 1.4.x before 1.4.11 and 1.6.x before 1.6.5 allows remote attackers to cause a denial of service (application crash) via a Novell capture file containing a record that is too small.


definition_id: oval:org.debian:def:599864626299449633465689985606364741
title: CVE-2012-0105 virtualbox-guest-additions-iso
description:
Unspecified vulnerability in the Oracle VM VirtualBox component in Oracle Virtualization 4.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Windows Guest Additions.


definition_id: oval:org.debian:def:336179163822192661082266455244933417030
title: CVE-2012-0206 pdns
description:
common_startup.cc in PowerDNS (aka pdns) Authoritative Server before 2.9.22.5 and 3.x before 3.0.1 allows remote attackers to cause a denial of service (packet loop) via a crafted UDP DNS response.


definition_id: oval:org.debian:def:35302862211821000285344905188692167382
title: CVE-2012-0208 gridengine
description:
Unspecified vulnerability in the Oracle Grid Engine component in Oracle Sun Products Suite 6.1 and 6.2 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to qrsh.


definition_id: oval:org.debian:def:86938574964290359892966000824251453380
title: CVE-2012-0210 devscripts
description:
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.


definition_id: oval:org.debian:def:195204779616270000336497795289533876484
title: CVE-2012-0211 devscripts
description:
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.


definition_id: oval:org.debian:def:305364935724307525649584173322319222361
title: CVE-2012-0212 devscripts
description:
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.


definition_id: oval:org.debian:def:181913961855979130794306809378949607960
title: CVE-2012-0214 apt
description:
The pkgAcqMetaClearSig::Failed method in apt-pkg/acquire-item.cc in Advanced Package Tool (APT) 0.8.11 through 0.8.15.10 and 0.8.16 before 0.8.16~exp13, when updating from repositories that use InRelease files, allows man-in-the-middle attackers to install arbitrary packages by preventing a user from downloading the new InRelease file, which leaves the original InRelease file active and makes it more difficult to detect that the Packages file is modified and unsigned.


definition_id: oval:org.debian:def:333606287336150091076227268553585951051
title: CVE-2012-0215 tryton-server
description:
model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via a (1) create, (2) write, (3) delete, or (4) copy rpc call.


definition_id: oval:org.debian:def:240512108016554828154511080264985647258
title: CVE-2012-0216 apache2
description:
The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.


definition_id: oval:org.debian:def:187471190689398168666228529122822933886
title: CVE-2012-0217 kfreebsd-10
description:
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application.  NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier.


definition_id: oval:org.debian:def:5169135898683541967133190708602707417
title: CVE-2012-0218 xen
description:
Xen 3.4, 4.0, and 4.1, when the guest OS has not registered a handler for a syscall or sysenter instruction, does not properly clear a flag for exception injection when injecting a General Protection Fault, which allows local PV guest OS users to cause a denial of service (guest crash) by later triggering an exception that would normally be handled within Xen.


definition_id: oval:org.debian:def:308617384136291864881642624577881507030
title: CVE-2012-0219 socat
description:
Heap-based buffer overflow in the xioscan_readline function in xio-readline.c in socat 1.4.0.0 through 1.7.2.0 and 2.0.0-b1 through 2.0.0-b4 allows local users to execute arbitrary code via the READLINE address.


definition_id: oval:org.debian:def:321958339554102291943464812563062258991
title: CVE-2012-0220 ikiwiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in the meta plugin (Plugin/meta.pm) in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the (1) author or (2) authorurl meta tags.


definition_id: oval:org.debian:def:326116592721714661444635840298361291723
title: CVE-2012-0247 imagemagick
description:
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in the ResolutionUnit tag in the EXIF IFD0 of an image.


definition_id: oval:org.debian:def:190256077704789712533050141639349332121
title: CVE-2012-0248 imagemagick
description:
ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference the beginning of the IDF.


definition_id: oval:org.debian:def:7788331921107116958476702992617847429
title: CVE-2012-0249 quagga
description:
Buffer overflow in the ospf_ls_upd_list_lsa function in ospf_packet.c in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a Link State Update (aka LS Update) packet that is smaller than the length specified in its header.


definition_id: oval:org.debian:def:67658551292615999207198264105895058561
title: CVE-2012-0250 quagga
description:
Buffer overflow in the OSPFv2 implementation in ospfd in Quagga before 0.99.20.1 allows remote attackers to cause a denial of service (daemon crash) via a Link State Update (aka LS Update) packet containing a network-LSA link-state advertisement for which the data-structure length is smaller than the value in the Length header field.


definition_id: oval:org.debian:def:161799039601062517079190939646554288107
title: CVE-2012-0255 quagga
description:
The BGP implementation in bgpd in Quagga before 0.99.20.1 does not properly use message buffers for OPEN messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a message associated with a malformed Four-octet AS Number Capability (aka AS4 capability).


definition_id: oval:org.debian:def:27114140641480988796822804879121732240
title: CVE-2012-0256 trafficserver
description:
Apache Traffic Server 2.0.x and 3.0.x before 3.0.4 and 3.1.x before 3.1.3 does not properly allocate heap memory, which allows remote attackers to cause a denial of service (daemon crash) via a long HTTP Host header.


definition_id: oval:org.debian:def:260577131111856522171783529083108617316
title: CVE-2012-0259 imagemagick
description:
The GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (crash) via a zero value in the component count of an EXIF XResolution tag in a JPEG file, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:5215613972211058534042921351316542391
title: CVE-2012-0260 imagemagick
description:
The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a crafted sequence of restart markers.


definition_id: oval:org.debian:def:136635093342979291423759482405977833058
title: CVE-2012-0270 csound
description:
Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c.


definition_id: oval:org.debian:def:320856691869085223204088806796430350119
title: CVE-2012-0283 dokuwiki
description:
Cross-site scripting (XSS) vulnerability in the tpl_mediaFileList function in inc/template.php in DokuWiki before 2012-01-25b allows remote attackers to inject arbitrary web script or HTML via the ns parameter in a medialist action to lib/exe/ajax.php.


definition_id: oval:org.debian:def:2964705815607301383709334859138880
title: CVE-2012-0287 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via the query string in a POST operation that is not properly handled by the "Duplicate comment detected" feature.


definition_id: oval:org.debian:def:221257429217732128113197479779427309672
title: CVE-2012-0390 gnutls28
description:
The DTLS implementation in GnuTLS 3.0.10 and earlier executes certain error-handling code only if there is a specific relationship between a padding length and the ciphertext size, which makes it easier for remote attackers to recover partial plaintext via a timing side-channel attack, a related issue to CVE-2011-4108.


definition_id: oval:org.debian:def:58243779005558150828008372511714058484
title: CVE-2012-0441 nss
description:
The ASN.1 decoder in the QuickDER decoder in Mozilla Network Security Services (NSS) before 3.13.4, as used in Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10, allows remote attackers to cause a denial of service (application crash) via a zero-length item, as demonstrated by (1) a zero-length basic constraint or (2) a zero-length field in an OCSP response.


definition_id: oval:org.debian:def:246113694769545078930410634465568818980
title: CVE-2012-0444 libvorbis
description:
Mozilla Firefox before 3.6.26 and 4.x through 9.0, Thunderbird before 3.1.18 and 5.0 through 9.0, and SeaMonkey before 2.7 do not properly initialize nsChildView data structures, which allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted Ogg Vorbis file.


definition_id: oval:org.debian:def:177145819270155398092279578643273066939
title: CVE-2012-0523 gridengine
description:
Unspecified vulnerability in the Oracle Grid Engine component in Oracle Sun Products Suite 6.1 and 6.2 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to sgepasswd.


definition_id: oval:org.debian:def:239927766968272487087079658219413074386
title: CVE-2012-0698 trousers
description:
tcsd in TrouSerS before 0.3.10 allows remote attackers to cause a denial of service (daemon crash) via a crafted type_offset value in a TCP packet to port 30003.


definition_id: oval:org.debian:def:261798922604222635528328310533439160736
title: CVE-2012-0786 augeas
description:
The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augnew file.


definition_id: oval:org.debian:def:118889870307477176494574805033480915836
title: CVE-2012-0787 augeas
description:
The clone_file function in transfer.c in Augeas before 1.0.0, when copy_if_rename_fails is set and EXDEV or EBUSY is returned by the rename function, allows local users to overwrite arbitrary files and obtain sensitive information via a bind mount on the (1) .augsave or (2) destination file when using the backup save option, or (3) .augnew file when using the newfile save option.


definition_id: oval:org.debian:def:198751413612955871218627535327767166570
title: CVE-2012-0790 smokeping
description:
Cross-site scripting (XSS) vulnerability in smokeping_cgi in Smokeping 2.4.2, 2.6.6, and other versions before 2.6.7 allows remote attackers to inject arbitrary web script or HTML via the displaymode parameter.


definition_id: oval:org.debian:def:314457172266912082985792289682206642973
title: CVE-2012-0805 sqlalchemy
description:
Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to the (3) select.limit or (4) select.offset function.


definition_id: oval:org.debian:def:148729467697934560316048500361482158833
title: CVE-2012-0806 bip
description:
Buffer overflow in Bip 0.8.8 and earlier might allow remote authenticated users to execute arbitrary code via vectors involving a series of TCP connections that triggers use of many open file descriptors.


definition_id: oval:org.debian:def:245410340811855304679560909173079221320
title: CVE-2012-0808 as31
description:
as31 2.3.1-4 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack.


definition_id: oval:org.debian:def:129889243681968130798365286706589027189
title: CVE-2012-0809 sudo
description:
Format string vulnerability in the sudo_debug function in Sudo 1.8.0 through 1.8.3p1 allows local users to execute arbitrary code via format string sequences in the program name for sudo.


definition_id: oval:org.debian:def:67407489735958724394634018405086039653
title: CVE-2012-0811 postfixadmin
description:
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files generated by backup.php.


definition_id: oval:org.debian:def:108351663038918769195522441395311652092
title: CVE-2012-0813 wicd
description:
Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords and other sensitive information.


definition_id: oval:org.debian:def:211648609711656542772450973633795412624
title: CVE-2012-0814 openssh
description:
The auth_parse_options function in auth-options.c in sshd in OpenSSH before 5.7 provides debug messages containing authorized_keys command options, which allows remote authenticated users to obtain potentially sensitive information by reading these messages, as demonstrated by the shared user account required by Gitolite.  NOTE: this can cross privilege boundaries because a user account may intentionally have no shell or filesystem access, and therefore may have no supported way to read an authorized_keys file in its own home directory.


definition_id: oval:org.debian:def:285405675174120236408866090492221570631
title: CVE-2012-0815 rpm
description:
The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.


definition_id: oval:org.debian:def:236966942150072259853184120377467962933
title: CVE-2012-0817 samba
description:
Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.


definition_id: oval:org.debian:def:196845989327006034160676719203310299425
title: CVE-2012-0823 libvpx
description:
VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".


definition_id: oval:org.debian:def:205018761091757654152681362161718328346
title: CVE-2012-0839 ocaml
description:
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.


definition_id: oval:org.debian:def:227304914570696975888446855958595607304
title: CVE-2012-0840 apr
description:
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.


definition_id: oval:org.debian:def:157681931862208759491868558509986370252
title: CVE-2012-0845 python2.7
description:
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.


definition_id: oval:org.debian:def:313804591106963872323127866581382558155
title: CVE-2012-0851 ffmpeg
description:
The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.


definition_id: oval:org.debian:def:56831378546460785371184141359511761483
title: CVE-2012-0852 ffmpeg
description:
The adpcm_decode_frame function in adpcm.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an ADPCM file with the number of channels not equal to two.


definition_id: oval:org.debian:def:15368297524700359890409612763010130779
title: CVE-2012-0853 ffmpeg
description:
The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.


definition_id: oval:org.debian:def:285929121381521720500089468717187071710
title: CVE-2012-0858 ffmpeg
description:
The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free".


definition_id: oval:org.debian:def:113695740226119415520850448989896396427
title: CVE-2012-0859 ffmpeg
description:
The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.


definition_id: oval:org.debian:def:119391550152121512204852707746033461995
title: CVE-2012-0862 xinetd
description:
builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.


definition_id: oval:org.debian:def:77001984691960511261416967419906044364
title: CVE-2012-0863 mumble
description:
Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.


definition_id: oval:org.debian:def:17894724979543453776367688980805482569
title: CVE-2012-0869 fex
description:
Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.


definition_id: oval:org.debian:def:337340061920089859762920984892338728825
title: CVE-2012-0870 samba
description:
CVE-2012-0870 samba: Any Batched ("AndX") request processing infinite recursion and heap-based buffer overflow


definition_id: oval:org.debian:def:303682375987437202571172507758504981889
title: CVE-2012-0871 systemd
description:
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.


definition_id: oval:org.debian:def:202537430854012306302126147955404109290
title: CVE-2012-0875 systemtap
description:
SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.


definition_id: oval:org.debian:def:283037135310975003366366020001001777571
title: CVE-2012-0876 expat
description:
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.


definition_id: oval:org.debian:def:128667523317966163563555304001486259507
title: CVE-2012-0878 pastescript
description:
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.


definition_id: oval:org.debian:def:262687845081370030573449575338304452803
title: CVE-2012-0884 openssl
description:
The implementation of Cryptographic Message Syntax (CMS) and PKCS #7 in OpenSSL before 0.9.8u and 1.x before 1.0.0h does not properly restrict certain oracle behavior, which makes it easier for context-dependent attackers to decrypt data via a Million Message Attack (MMA) adaptive chosen ciphertext attack.


definition_id: oval:org.debian:def:140140477243134976464699603065580469598
title: CVE-2012-0885 asterisk
description:
chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.


definition_id: oval:org.debian:def:112230453144059366664952887496907531803
title: CVE-2012-0908 simplesamlphp
description:
Cross-site scripting (XSS) vulnerability in logout.php in SimpleSAMLphp 1.8.1 and possibly other versions before 1.8.2 allows remote attackers to inject arbitrary web script or HTML via the link_href parameter.


definition_id: oval:org.debian:def:120410161790780853090748815198555377902
title: CVE-2012-0920 dropbear
description:
Use-after-free vulnerability in Dropbear SSH Server 0.52 through 2012.54, when command restriction and public key authentication are enabled, allows remote authenticated users to execute arbitrary code and bypass command restrictions via multiple crafted command requests, related to "channels concurrency."


definition_id: oval:org.debian:def:276249623650413817978870207188059556120
title: CVE-2012-0946 nvidia-graphics-drivers
description:
The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges.


definition_id: oval:org.debian:def:140195639426055579645223566997712822096
title: CVE-2012-0947 ffmpeg
description:
Heap-based buffer overflow in the vqa_decode_chunk function in the VQA codec (vqavideo.c) in libavcodec in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VQA media file in which the image size is not a multiple of the block size.


definition_id: oval:org.debian:def:93598070654603439015440552179708008671
title: CVE-2012-0951 nvidia-graphics-drivers
description:
A Memory Corruption Vulnerability exists in NVIDIA Graphics Drivers 29549 due to an unknown function in the file proc/driver/nvidia/registry.


definition_id: oval:org.debian:def:78870060819481279577962027678461162292
title: CVE-2012-0952 nvidia-graphics-drivers
description:
A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards, which may allow an attacker to overflow 49 bytes. This issue was fixed in version 295.53.


definition_id: oval:org.debian:def:76375030410853855391923249733795020375
title: CVE-2012-0953 nvidia-graphics-drivers
description:
A race condition was discovered in the Linux drivers for Nvidia graphics which allowed an attacker to exfiltrate kernel memory to userspace. This issue was fixed in version 295.53.


definition_id: oval:org.debian:def:132802988078937348998172008908328201814
title: CVE-2012-0954 apt
description:
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install altered packages via a man-in-the-middle (MITM) attack.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3587.


definition_id: oval:org.debian:def:23377272036841354004842811755394036160
title: CVE-2012-0955 software-properties
description:
software-properties was vulnerable to a person-in-the-middle attack due to incorrect TLS certificate validation in softwareproperties/ppa.py. software-properties didn't check TLS certificates under python2 and only checked certificates under python3 if a valid certificate bundle was provided. Fixed in software-properties version 0.92.


definition_id: oval:org.debian:def:330432147300891732265413885778380002581
title: CVE-2012-0957 linux
description:
The override_release function in kernel/sys.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from kernel stack memory via a uname system call in conjunction with a UNAME26 personality.


definition_id: oval:org.debian:def:151993154690194828236144626472470945163
title: CVE-2012-0961 apt
description:
Apt 0.8.16~exp5ubuntu13.x before 0.8.16~exp5ubuntu13.6, 0.8.16~exp12ubuntu10.x before 0.8.16~exp12ubuntu10.7, and 0.9.7.5ubuntu5.x before 0.9.7.5ubuntu5.2, as used in Ubuntu, uses world-readable permissions for /var/log/apt/term.log, which allows local users to obtain sensitive shell information by reading the log file.


definition_id: oval:org.debian:def:52722772254815539820422624793789505766
title: CVE-2012-1012 krb5
description:
server/server_stubs.c in the kadmin protocol implementation in MIT Kerberos 5 (aka krb5) 1.10 before 1.10.1 does not properly restrict access to (1) SET_STRING and (2) GET_STRINGS operations, which might allow remote authenticated administrators to modify or read string attributes by leveraging the global list privilege.


definition_id: oval:org.debian:def:230570003541837938479869213638042587042
title: CVE-2012-1013 krb5
description:
The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.


definition_id: oval:org.debian:def:130126822515879167828263076623025730964
title: CVE-2012-1014 krb5
description:
The process_as_req function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.10.x before 1.10.3 does not initialize a certain structure member, which allows remote attackers to cause a denial of service (uninitialized pointer dereference and daemon crash) or possibly execute arbitrary code via a malformed AS-REQ request.


definition_id: oval:org.debian:def:90268608836723065096533527488832767673
title: CVE-2012-1015 krb5
description:
The kdc_handle_protected_negotiation function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x before 1.9.5, and 1.10.x before 1.10.3 attempts to calculate a checksum before verifying that the key type is appropriate for a checksum, which allows remote attackers to execute arbitrary code or cause a denial of service (uninitialized pointer free, heap memory corruption, and daemon crash) via a crafted AS-REQ request.


definition_id: oval:org.debian:def:44480886095986694117207269511021481655
title: CVE-2012-1016 krb5
description:
The pkinit_server_return_padata function in plugins/preauth/pkinit/pkinit_srv.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 attempts to find an agility KDF identifier in inappropriate circumstances, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted Draft 9 request.


definition_id: oval:org.debian:def:335087038417147186119378901602961744909
title: CVE-2012-1033 bind9
description:
The resolver in ISC BIND 9 through 9.8.1-P1 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.


definition_id: oval:org.debian:def:102913934818448271323208469633945254077
title: CVE-2012-1053 puppet
description:
The change_user method in the SUIDManager (lib/puppet/util/suidmanager.rb) in Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3 does not properly manage group privileges, which allows local users to gain privileges via vectors related to (1) the change_user not dropping supplementary groups in certain conditions, (2) changes to the eguid without associated changes to the egid, or (3) the addition of the real gid to supplementary groups.


definition_id: oval:org.debian:def:34312005635310481986611246441920320455
title: CVE-2012-1054 puppet
description:
Puppet 2.6.x before 2.6.14 and 2.7.x before 2.7.11, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x before 2.0.3, when managing a user login file with the k5login resource type, allows local users to gain privileges via a symlink attack on .k5login.


definition_id: oval:org.debian:def:40696033802830844468668282352888392515
title: CVE-2012-1093 xorg
description:
The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation during package installation.


definition_id: oval:org.debian:def:257257318680217372842687059552653481359
title: CVE-2012-1095 osc
description:
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.


definition_id: oval:org.debian:def:225567467948578349669759723276439548377
title: CVE-2012-1098 rails
description:
Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.


definition_id: oval:org.debian:def:116044864553663029114974768378845011812
title: CVE-2012-1099 rails
description:
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.


definition_id: oval:org.debian:def:13001326614095291562215263706213535344
title: CVE-2012-1101 systemd
description:
systemd 37-1 does not properly handle non-existent services, which causes a denial of service (failure of login procedure).


definition_id: oval:org.debian:def:298555348201846096799010380715582226830
title: CVE-2012-1102 libxml-atom-perl
description:
It was discovered that the XML::Atom Perl module before version 0.39 did not disable external entities when parsing XML from potentially untrusted sources. This may allow attackers to gain read access to otherwise protected resources, depending on how the library is used.


definition_id: oval:org.debian:def:235495879339820662801876610809091530248
title: CVE-2012-1103 notmuch
description:
emacs/notmuch-mua.el in Notmuch before 0.11.1, when using the Emacs interface, allows user-assisted remote attackers to read arbitrary files via crafted MML tags, which are not properly quoted in an email reply cna cause the files to be attached to the message.


definition_id: oval:org.debian:def:323745870083320951558172319087829953788
title: CVE-2012-1107 taglib
description:
The analyzeCurrent function in ape/apeproperties.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted sampleRate in an ape file, which triggers a divide-by-zero error.


definition_id: oval:org.debian:def:209510441685224467421851687351912257748
title: CVE-2012-1108 taglib
description:
The parse function in ogg/xiphcomment.cpp in TagLib 1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted vendorLength field in an ogg file.


definition_id: oval:org.debian:def:80059054266039554100263564265102434054
title: CVE-2012-1111 lightdm
description:
lightdm before 1.0.9 does not properly close file descriptors before opening a child process, which allows local users to write to the lightdm log or have other unspecified impact.


definition_id: oval:org.debian:def:12428646657802331097998073037131438730
title: CVE-2012-1128 freetype
description:
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.


definition_id: oval:org.debian:def:97120429165986509417918293665556355767
title: CVE-2012-1129 freetype
description:
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font.


definition_id: oval:org.debian:def:304807467783314133057301145630681097577
title: CVE-2012-1131 freetype
description:
CVE-2012-1131 freetype: incorrect type cast allowing input sanity check bypass in ft_smooth_render_generic() (#35604)


definition_id: oval:org.debian:def:114630412518701309100257481596141164369
title: CVE-2012-1133 freetype
description:
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.


definition_id: oval:org.debian:def:243473306581874005855856683441024592332
title: CVE-2012-1135 freetype
description:
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the NPUSHB and NPUSHW instructions in a TrueType font.


definition_id: oval:org.debian:def:62154596132937638280343933010937119545
title: CVE-2012-1138 freetype
description:
FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the MIRP instruction in a TrueType font.


definition_id: oval:org.debian:def:89532310091984339331283884167435037529
title: CVE-2012-1141 freetype
description:
CVE-2012-1141 freetype: BDF parser _bdf_list_split() fails to properly initialize field array (#35658)


definition_id: oval:org.debian:def:175879500206312839701063764647670661214
title: CVE-2012-1142 freetype
description:
CVE-2012-1142 freetype: incorrect computation of number of glyphs in FNT_Face_Init() for FNT/FON files (#35659)


definition_id: oval:org.debian:def:212506283971377995819040180357337411388
title: CVE-2012-1148 expat
description:
Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (memory consumption) via a large number of crafted XML files that cause improperly-handled reallocation failures when expanding entities.


definition_id: oval:org.debian:def:96704230206116841415984235995136534859
title: CVE-2012-1149 libreoffice
description:
CVE-2012-1149 openoffice.org, libreoffice: Integer overflows, leading to heap-buffer overflows in JPEG, PNG and BMP reader implementations


definition_id: oval:org.debian:def:260153015270879221168562910879462384229
title: CVE-2012-1150 python2.7
description:
Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.


definition_id: oval:org.debian:def:270998601535397860567778717395399491707
title: CVE-2012-1151 libdbd-pg-perl
description:
Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function.


definition_id: oval:org.debian:def:234717658526896937289043780800949040840
title: CVE-2012-1152 libyaml-libyaml-perl
description:
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.


definition_id: oval:org.debian:def:82595216768401249775468786136293141140
title: CVE-2012-1162 libzip
description:
Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct."


definition_id: oval:org.debian:def:3143111051068582551141517532606078541
title: CVE-2012-1163 libzip
description:
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.


definition_id: oval:org.debian:def:234842579217745224808107837439685626594
title: CVE-2012-1164 openldap
description:
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned.


definition_id: oval:org.debian:def:217406398371236695550833389321142347695
title: CVE-2012-1165 openssl
description:
The mime_param_cmp function in crypto/asn1/asn_mime.c in OpenSSL before 0.9.8u and 1.x before 1.0.0h allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message, a different vulnerability than CVE-2006-7250.


definition_id: oval:org.debian:def:241594773083272949200104031840357983322
title: CVE-2012-1166 ldm
description:
The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window.


definition_id: oval:org.debian:def:171609855697197842381722503015353766825
title: CVE-2012-1174 systemd
description:
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."


definition_id: oval:org.debian:def:19533622891727944936164149863515985300
title: CVE-2012-1176 pyfribidi
description:
Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence.


definition_id: oval:org.debian:def:328935159853221091397107762234221951635
title: CVE-2012-1177 libgdata
description:
libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.


definition_id: oval:org.debian:def:163603321436956099840001149185379129150
title: CVE-2012-1178 pidgin
description:
The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.


definition_id: oval:org.debian:def:249265462269530083109942112646327327276
title: CVE-2012-1180 nginx
description:
Use-after-free vulnerability in nginx before 1.0.14 and 1.1.x before 1.1.17 allows remote HTTP servers to obtain sensitive information from process memory via a crafted backend response, in conjunction with a client request.


definition_id: oval:org.debian:def:192511087352086749287111240491424911679
title: CVE-2012-1181 libapache2-mod-fcgid
description:
fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.


definition_id: oval:org.debian:def:295685204550368717895151621936000648514
title: CVE-2012-1182 samba
description:
The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a crafted RPC call.


definition_id: oval:org.debian:def:119274167960861060825647905691641723141
title: CVE-2012-1183 asterisk
description:
Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.


definition_id: oval:org.debian:def:70553881862023173593343041225715483079
title: CVE-2012-1184 asterisk
description:
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.


definition_id: oval:org.debian:def:5453925975726967942164533132591101396
title: CVE-2012-1185 imagemagick
description:
Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.


definition_id: oval:org.debian:def:237005609637257645931955655654837847798
title: CVE-2012-1186 imagemagick
description:
Integer overflow in the SyncImageProfiles function in profile.c in ImageMagick 6.7.5-8 and earlier allows remote attackers to cause a denial of service (infinite loop) via crafted IOP tag offsets in the IFD in an image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0248.


definition_id: oval:org.debian:def:126609148471311946407781725991455010731
title: CVE-2012-1189 torcs
description:
Stack-based buffer overflow in modules/graphic/ssgraph/grsound.cpp in The Open Racing Car Simulator (TORCS) before 1.3.3 and Speed Dreams allows user-assisted remote attackers to execute arbitrary code via a long file name in an engine sample attribute in an xml configuration file.


definition_id: oval:org.debian:def:218605275203629512121878697227839091015
title: CVE-2012-1253 roundcube
description:
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 0.7, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via vectors involving an embedded image attachment.


definition_id: oval:org.debian:def:245615866065216563374580492144703712201
title: CVE-2012-1293 fex
description:
Multiple cross-site scripting (XSS) vulnerabilities in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20111129-2 allow remote attackers to inject arbitrary web script or HTML via the (1) to or (2) from parameters.


definition_id: oval:org.debian:def:327066290170731258983724840078615192558
title: CVE-2012-1410 kadu
description:
Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.


definition_id: oval:org.debian:def:23334551982933474341983668988891541801
title: CVE-2012-1419 clamav
description:
The TAR file parser in ClamAV 0.96.4 and Quick Heal (aka Cat QuickHeal) 11.00 allows remote attackers to bypass malware detection via a POSIX TAR file with an initial [aliases] character sequence. NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.


definition_id: oval:org.debian:def:125473091418015739622140413662179316507
title: CVE-2012-1457 clamav
description:
The TAR file parser in Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Emsisoft Anti-Malware 5.1.0.1, eSafe 7.0.17.0, F-Prot Antivirus 4.6.2.117, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field that exceeds the total TAR file size.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.


definition_id: oval:org.debian:def:277603086937615725325581503404022888645
title: CVE-2012-1458 clamav
description:
The Microsoft CHM file parser in ClamAV 0.96.4 and Sophos Anti-Virus 4.61.0 allows remote attackers to bypass malware detection via a crafted reset interval in the LZXC header of a CHM file.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different CHM parser implementations.


definition_id: oval:org.debian:def:270188804294322965352179649172216707859
title: CVE-2012-1459 clamav
description:
The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir 7.11.1.163, Antiy Labs AVL SDK 2.0.3.7, avast! Antivirus 4.8.1351.0 and 5.0.677.0, AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Quick Heal (aka Cat QuickHeal) 11.00, ClamAV 0.96.4, Command Antivirus 5.2.11.5, Comodo Antivirus 7424, Emsisoft Anti-Malware 5.1.0.1, F-Prot Antivirus 4.6.2.117, F-Secure Anti-Virus 9.0.16160.0, Fortinet Antivirus 4.2.254.0, G Data AntiVirus 21, Ikarus Virus Utilities T3 Command Line Scanner 1.1.97.0, Jiangmin Antivirus 13.0.900, K7 AntiVirus 9.77.3565, Kaspersky Anti-Virus 7.0.0.125, McAfee Anti-Virus Scanning Engine 5.400.0.1158, McAfee Gateway (formerly Webwasher) 2010.1C, Antimalware Engine 1.1.6402.0 in Microsoft Security Essentials 2.0, NOD32 Antivirus 5795, Norman Antivirus 6.06.12, nProtect Anti-Virus 2011-01-17.01, Panda Antivirus 10.0.2.7, PC Tools AntiVirus 7.0.3.5, Rising Antivirus 22.83.00.03, Sophos Anti-Virus 4.61.0, AVEngine 20101.3.0.103 in Symantec Endpoint Protection 11, Trend Micro AntiVirus 9.120.0.1004, Trend Micro HouseCall 9.120.0.1004, VBA32 3.12.14.2, and VirusBuster 13.6.151.0 allows remote attackers to bypass malware detection via a TAR archive entry with a length field corresponding to that entire entry, plus part of the header of the next entry.  NOTE: this may later be SPLIT into multiple CVEs if additional information is published showing that the error occurred independently in different TAR parser implementations.


definition_id: oval:org.debian:def:147145787606777957669734577875184752499
title: CVE-2012-1502 python-pam
description:
Double free vulnerability in the PyPAM_conv in PAMmodule.c in PyPam 0.5.0 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a NULL byte in a password string.


definition_id: oval:org.debian:def:261985964457995228866619143943714491625
title: CVE-2012-1570 maradns
description:
The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 overwrites cached server names and TTL values in NS records during the processing of a response to an A record query, which allows remote attackers to trigger continued resolvability of revoked domain names via a "ghost domain names" attack.


definition_id: oval:org.debian:def:72481517594361321521108335989421755116
title: CVE-2012-1571 file
description:
file before 5.11 and libmagic allow remote attackers to cause a denial of service (crash) via a crafted Composite Document File (CDF) file that triggers (1) an out-of-bounds read or (2) an invalid pointer dereference.


definition_id: oval:org.debian:def:211455427057215862405186451073851007232
title: CVE-2012-1573 gnutls28
description:
gnutls_cipher.c in libgnutls in GnuTLS before 2.12.17 and 3.x before 3.0.15 does not properly handle data encrypted with a block cipher, which allows remote attackers to cause a denial of service (heap memory corruption and application crash) via a crafted record, as demonstrated by a crafted GenericBlockCipher structure.


definition_id: oval:org.debian:def:179435424688585978468127741436144390751
title: CVE-2012-1581 mediawiki
description:
MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.


definition_id: oval:org.debian:def:215830637272813977619117638078773297547
title: CVE-2012-1582 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension.


definition_id: oval:org.debian:def:114246072938213924930412181052565718316
title: CVE-2012-1584 taglib
description:
Integer overflow in the mid function in toolkit/tbytevector.cpp in TagLib 1.7 and earlier allows context-dependent attackers to cause a denial of service (application crash) via a crafted file header field in a media file, which triggers a large memory allocation.


definition_id: oval:org.debian:def:200970976671662256873023856639257333739
title: CVE-2012-1585 nova
description:
OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name.


definition_id: oval:org.debian:def:25233649989070895519073637024630064643
title: CVE-2012-1586 cifs-utils
description:
mount.cifs in cifs-utils 2.6 allows local users to determine the existence of arbitrary files or directories via the file path in the second argument, which reveals their existence in an error message.


definition_id: oval:org.debian:def:255371129984853849637940916717654254739
title: CVE-2012-1593 wireshark
description:
epan/dissectors/packet-ansi_a.c in the ANSI A dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed packet.


definition_id: oval:org.debian:def:106322239244432943271734326820782005838
title: CVE-2012-1594 wireshark
description:
epan/dissectors/packet-ieee80211.c in the IEEE 802.11 dissector in Wireshark 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:116768925589131716494075881016653967188
title: CVE-2012-1595 wireshark
description:
CVE-2012-1595 wireshark: Heap-based buffer overflow when reading ERF packets from pcap/pcap-ng trace files


definition_id: oval:org.debian:def:2589363416830313251262108360343683289
title: CVE-2012-1596 wireshark
description:
The mp2t_process_fragmented_payload function in epan/dissectors/packet-mp2t.c in the MP2T dissector in Wireshark 1.4.x before 1.4.12 and 1.6.x before 1.6.6 allows remote attackers to cause a denial of service (application crash) via a packet containing an invalid pointer value that triggers an incorrect memory-allocation attempt.


definition_id: oval:org.debian:def:108912033931805050854346023636028176907
title: CVE-2012-1600 phppgadmin
description:
Multiple cross-site scripting (XSS) vulnerabilities in functions.php in phpPgAdmin before 5.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) type of a function.


definition_id: oval:org.debian:def:106084130099563101032092649521785223235
title: CVE-2012-1610 imagemagick
description:
Integer overflow in the GetEXIFProperty function in magick/property.c in ImageMagick before 6.7.6-4 allows remote attackers to cause a denial of service (out-of-bounds read) via a large component count for certain EXIF tags in a JPEG image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0259.


definition_id: oval:org.debian:def:267430776100136454630355221588296905515
title: CVE-2012-1616 argyll
description:
Use-after-free vulnerability in icclib before 2.13, as used by Argyll CMS before 1.4 and possibly other programs, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted ICC profile file.


definition_id: oval:org.debian:def:176503431696505943007247163995655141626
title: CVE-2012-1620 suckless-tools
description:
slock 0.9 does not properly handle the XRaiseWindow event when the screen is locked, which might allow physically proximate attackers to obtain sensitive information by pressing a button, which reveals the desktop and active windows.


definition_id: oval:org.debian:def:46965385548916036043467546552236477021
title: CVE-2012-1663 gnutls28
description:
Double free vulnerability in libgnutls in GnuTLS before 3.0.14 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted certificate list.


definition_id: oval:org.debian:def:86360157753737117376166732833022120423
title: CVE-2012-1667 bind9
description:
ISC BIND 9.x before 9.7.6-P1, 9.8.x before 9.8.3-P1, 9.9.x before 9.9.1-P1, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P1 does not properly handle resource records with a zero-length RDATA section, which allows remote DNS servers to cause a denial of service (daemon crash or data corruption) or obtain sensitive information from process memory via a crafted record.


definition_id: oval:org.debian:def:40246504373803854137215886414712778967
title: CVE-2012-1775 vlc
description:
Stack-based buffer overflow in VideoLAN VLC media player before 2.0.1 allows remote attackers to execute arbitrary code via a crafted MMS:// stream.


definition_id: oval:org.debian:def:182640637621053442518047672960492597337
title: CVE-2012-1776 vlc
description:
Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.


definition_id: oval:org.debian:def:177545243704857963187689983384482743049
title: CVE-2012-1798 imagemagick
description:
The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted EXIF IFD in a TIFF image.


definition_id: oval:org.debian:def:117322158002991080085157990947273111425
title: CVE-2012-1820 quagga
description:
The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering (ORF) capability TLV in an OPEN message.


definition_id: oval:org.debian:def:171751031284442065890567375708529410120
title: CVE-2012-1836 inspircd
description:
Heap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses compression.


definition_id: oval:org.debian:def:30832548363769134431234821466158873813
title: CVE-2012-1906 puppet
description:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 uses predictable file names when installing Mac OS X packages from a remote source, which allows local users to overwrite arbitrary files or install arbitrary packages via a symlink attack on a temporary file in /tmp.


definition_id: oval:org.debian:def:78854738033259763112366925016871246971
title: CVE-2012-1986 puppet
description:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with an authorized SSL key and certain permissions on the puppet master to read arbitrary files via a symlink attack in conjunction with a crafted REST request for a file in a filebucket.


definition_id: oval:org.debian:def:282034840360360890113377138167448429215
title: CVE-2012-1987 puppet
description:
Unspecified vulnerability in Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys to (1) cause a denial of service (memory consumption) via a REST request to a stream that triggers a thread block, as demonstrated using CVE-2012-1986 and /dev/random; or (2) cause a denial of service (filesystem consumption) via crafted REST requests that use "a marshaled form of a Puppet::FileBucket::File object" to write to arbitrary file locations.


definition_id: oval:org.debian:def:284697990161762832149577201891858677493
title: CVE-2012-1988 puppet
description:
Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise (PE) Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full pathname contains shell metacharacters, then performing a filebucket request.


definition_id: oval:org.debian:def:169770168766167300395569177838332107481
title: CVE-2012-1989 puppet
description:
telnet.rb in Puppet 2.7.x before 2.7.13 and Puppet Enterprise (PE) 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows local users to overwrite arbitrary files via a symlink attack on the NET::Telnet connection log (/tmp/out.log).


definition_id: oval:org.debian:def:94698811553727945190365705188902886040
title: CVE-2012-2085 gajim
description:
The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.


definition_id: oval:org.debian:def:100398120584646039656563104257577935765
title: CVE-2012-2086 gajim
description:
SQL injection vulnerability in the get_last_conversation_lines function in common/logger.py in Gajim before 0.15 allows remote attackers to execute arbitrary SQL commands via the jig parameter.


definition_id: oval:org.debian:def:190288089643643244020066752863554989824
title: CVE-2012-2089 nginx
description:
Buffer overflow in ngx_http_mp4_module.c in the ngx_http_mp4_module module in nginx 1.0.7 through 1.0.14 and 1.1.3 through 1.1.18, when the mp4 directive is used, allows remote attackers to cause a denial of service (memory overwrite) or possibly execute arbitrary code via a crafted MP4 file.


definition_id: oval:org.debian:def:206131631025795435689133741391507081302
title: CVE-2012-2090 flightgear
description:
Multiple format string vulnerabilities in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service and possibly execute arbitrary code via format string specifiers in certain data chunk values in an aircraft xml model to (1) fgfs/flightgear/src/Cockpit/panel.cxx or (2) fgfs/flightgear/src/Network/generic.cxx, or (3) a scene graph model to simgear/simgear/scene/model/SGText.cxx.


definition_id: oval:org.debian:def:308735376354742120269457488078433278317
title: CVE-2012-2091 flightgear
description:
Multiple buffer overflows in FlightGear 2.6 and earlier and SimGear 2.6 and earlier allow user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a (1) long string in a rotor tag of an aircraft xml model to the Rotor::getValueforFGSet function in src/FDM/YASim/Rotor.cpp or (2) a crafted UDP packet to the SGSocketUDP::read function in simgear/simgear/simgear/io/sg_socket_udp.cxx.


definition_id: oval:org.debian:def:331295862287288250232940212623081244369
title: CVE-2012-2093 gajim
description:
src/common/latex.py in Gajim 0.15 allows local users to overwrite arbitrary files via a symlink attack on a temporary latex file, related to the get_tmpfile_name function.


definition_id: oval:org.debian:def:11222556416248484423819828993081171969
title: CVE-2012-2094 horizon
description:
Cross-site scripting (XSS) vulnerability in the refresh mechanism in the log viewer in horizon/static/horizon/js/horizon.js in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the guest console.


definition_id: oval:org.debian:def:38573532854993556496476053958720430063
title: CVE-2012-2095 wicd
description:
The SetWiredProperty function in the D-Bus interface in WICD before 1.7.2 allows local users to write arbitrary configuration settings and gain privileges via a crafted property name in a dbus message.


definition_id: oval:org.debian:def:221137921172319252286711858283887775121
title: CVE-2012-2098 libcommons-compress-java
description:
Algorithmic complexity vulnerability in the sorting algorithms in bzip2 compressing stream (BZip2CompressorOutputStream) in Apache Commons Compress before 1.4.1 allows remote attackers to cause a denial of service (CPU consumption) via a file with many repeating inputs.


definition_id: oval:org.debian:def:233407022240270910497762434646229057314
title: CVE-2012-2101 nova
description:
Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules.


definition_id: oval:org.debian:def:184506588586879776516948864090545142379
title: CVE-2012-2103 munin
description:
The qmailscan plugin for Munin 1.4.5 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.


definition_id: oval:org.debian:def:125954831531876902815217445662001318457
title: CVE-2012-2104 munin
description:
cgi-bin/munin-cgi-graph in Munin 2.x writes data to a log file without sanitizing non-printable characters, which might allow user-assisted remote attackers to inject terminal emulator escape sequences and execute arbitrary commands or delete arbitrary files via a crafted HTTP request.


definition_id: oval:org.debian:def:233910310169104195537734392914364022468
title: CVE-2012-2106 csound
description:
Integer overflow in the pv_import function in util/pv_import.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:216993397730359913711330083077725890375
title: CVE-2012-2107 csound
description:
Integer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:269018434650505808377841861453955511078
title: CVE-2012-2108 csound
description:
Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file.


definition_id: oval:org.debian:def:120057439867729158302405701478826465019
title: CVE-2012-2110 openssl
description:
The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in OpenSSL before 0.9.8v, 1.0.0 before 1.0.0i, and 1.0.1 before 1.0.1a does not properly interpret integer data, which allows remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.


definition_id: oval:org.debian:def:161224350336071846211726782690615475691
title: CVE-2012-2111 samba
description:
The (1) CreateAccount, (2) OpenAccount, (3) AddAccountRights, and (4) RemoveAccountRights LSA RPC procedures in smbd in Samba 3.4.x before 3.4.17, 3.5.x before 3.5.15, and 3.6.x before 3.6.5 do not properly restrict modifications to the privileges database, which allows remote authenticated users to obtain the "take ownership" privilege via an LSA connection.


definition_id: oval:org.debian:def:95999206789033064762845245588713740149
title: CVE-2012-2113 tiff
description:
CVE-2012-2113 libtiff: integer overflow in tiff2pdf leading to heap-buffer overflow when reading a tiled tiff file


definition_id: oval:org.debian:def:309404245529244106341338810861002748429
title: CVE-2012-2118 xorg-server
description:
Format string vulnerability in the LogVHdrMessageVerb function in os/log.c in X.Org X11 1.11 allows attackers to cause a denial of service or possibly execute arbitrary code via format string specifiers in an input device name.


definition_id: oval:org.debian:def:202607276113881902583487338484634270064
title: CVE-2012-2119 linux
description:
Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.


definition_id: oval:org.debian:def:256689948346349183188098959447083690455
title: CVE-2012-2120 texlive-extra
description:
latex2man in texlive-extra-utils 2011.20120322, and possibly other versions or packages, when used with the H or T option, allows local users to overwrite arbitrary files via a symlink attack on a temporary file.


definition_id: oval:org.debian:def:152698570372406507651309986740786335322
title: CVE-2012-2128 dokuwiki
description:
** DISPUTED **  Cross-site request forgery (CSRF) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to hijack the authentication of administrators for requests that add arbitrary users.  NOTE: this issue has been disputed by the vendor, who states that it is resultant from CVE-2012-2129: "the exploit code simply uses the XSS hole to extract a valid CSRF token."


definition_id: oval:org.debian:def:77749901381693360563751894836732328128
title: CVE-2012-2129 dokuwiki
description:
Cross-site scripting (XSS) vulnerability in doku.php in DokuWiki 2012-01-25 Angua allows remote attackers to inject arbitrary web script or HTML via the target parameter in an edit action.


definition_id: oval:org.debian:def:198535676118708452035336829050524943862
title: CVE-2012-2137 linux
description:
Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.


definition_id: oval:org.debian:def:115664276148004033700951866872475610783
title: CVE-2012-2139 ruby-mail
description:
Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter.


definition_id: oval:org.debian:def:75294553171107673273099029889612089533
title: CVE-2012-2140 ruby-mail
description:
The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery.


definition_id: oval:org.debian:def:39724442502282924279268494382044903724
title: CVE-2012-2141 net-snmp
description:
Array index error in the handle_nsExtendOutput2Table function in agent/mibgroup/agent/extend.c in Net-SNMP 5.7.1 allows remote authenticated users to cause a denial of service (out-of-bounds read and snmpd crash) via an SNMP GET request for an entry not in the extension table.


definition_id: oval:org.debian:def:334542370508798705380256754586128759107
title: CVE-2012-2142 poppler
description:
The error function in Error.cc in poppler before 0.21.4 allows remote attackers to execute arbitrary commands via a PDF containing an escape sequence for a terminal emulator.


definition_id: oval:org.debian:def:324276392755837523548340544147673698011
title: CVE-2012-2144 horizon
description:
Session fixation vulnerability in OpenStack Dashboard (Horizon) folsom-1 and 2012.1 allows remote attackers to hijack web sessions via the sessionid cookie.


definition_id: oval:org.debian:def:64653323755053305410757465287423741848
title: CVE-2012-2146 elixir
description:
Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.


definition_id: oval:org.debian:def:258351602466858875491165463018440414698
title: CVE-2012-2147 munin
description:
munin-cgi-graph in Munin 2.0 rc4 allows remote attackers to cause a denial of service (disk or memory consumption) via many image requests with large values in the (1) size_x or (2) size_y parameters.


definition_id: oval:org.debian:def:180217164539287075923052231336885583445
title: CVE-2012-2149 libwpd
description:
The WPXContentListener::_closeTableRow function in WPXContentListener.cpp in libwpd 0.8.8, as used by OpenOffice.org (OOo) before 3.4, allows remote attackers to execute arbitrary code via a crafted Wordperfect .WPD document that causes a negative array index to be used.  NOTE: some sources report this issue as an integer overflow.


definition_id: oval:org.debian:def:249569824148333943184353647483950617862
title: CVE-2012-2150 xfsprogs
description:
xfs_metadump in xfsprogs before 3.2.4 does not properly obfuscate file data, which allows remote attackers to obtain sensitive information by reading a generated image.


definition_id: oval:org.debian:def:54510129582219489059632774535102260144
title: CVE-2012-2151 spip
description:
Multiple cross-site scripting (XSS) vulnerabilities in SPIP 1.9.x before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:48884143493761127372417274784596959708
title: CVE-2012-2186 asterisk
description:
Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert6, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 allows remote authenticated users to execute arbitrary commands by leveraging originate privileges and providing an ExternalIVR value in an AMI Originate action.


definition_id: oval:org.debian:def:128208300137770947721264060869696073813
title: CVE-2012-2214 pidgin
description:
proxy.c in libpurple in Pidgin before 2.10.4 does not properly handle canceled SOCKS5 connection attempts, which allows user-assisted remote authenticated users to cause a denial of service (application crash) via a sequence of XMPP file-transfer requests.


definition_id: oval:org.debian:def:292617649882021793986563999546362404911
title: CVE-2012-2240 devscripts
description:
scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."


definition_id: oval:org.debian:def:126148735786521405832818042170156161372
title: CVE-2012-2241 devscripts
description:
scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.


definition_id: oval:org.debian:def:146331657215056895766269462776633999501
title: CVE-2012-2242 devscripts
description:
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.


definition_id: oval:org.debian:def:321383867376363262297139811580380015968
title: CVE-2012-2249 tor
description:
Tor before 0.2.3.23-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a renegotiation attempt that occurs after the initiation of the V3 link protocol.


definition_id: oval:org.debian:def:61094304599653105378272323450216020949
title: CVE-2012-2250 tor
description:
Tor before 0.2.3.24-rc allows remote attackers to cause a denial of service (assertion failure and daemon exit) by performing link protocol negotiation incorrectly.


definition_id: oval:org.debian:def:173282231260551698449745613398892431685
title: CVE-2012-2313 linux
description:
The rio_ioctl function in drivers/net/ethernet/dlink/dl2k.c in the Linux kernel before 3.3.7 does not restrict access to the SIOCSMIIREG command, which allows local users to write data to an Ethernet adapter via an ioctl call.


definition_id: oval:org.debian:def:105579148229748333298773464967786680425
title: CVE-2012-2318 pidgin
description:
msg.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.4 does not properly handle crafted characters, which allows remote servers to cause a denial of service (application crash) by placing these characters in a text/plain message.


definition_id: oval:org.debian:def:267736487712507301829685364146433922675
title: CVE-2012-2319 linux
description:
CVE-2012-2319 kernel: Buffer overflow in the HFS plus filesystem (different issue than CVE-2009-4020)


definition_id: oval:org.debian:def:250707497499362135731325477376463778984
title: CVE-2012-2320 connman
description:
ConnMan before 0.85 does not ensure that netlink messages originate from the kernel, which allows remote attackers to bypass intended access restrictions and cause a denial of service via a crafted netlink message.


definition_id: oval:org.debian:def:59940440781169066773081381791743552231
title: CVE-2012-2321 connman
description:
The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) host name or (2) domain name in a DHCP reply.


definition_id: oval:org.debian:def:139462063504107623027311047035169256478
title: CVE-2012-2322 connman
description:
Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before 0.85 allows remote attackers to cause a denial of service (infinite loop and crash) via an invalid length value in a DHCP packet.


definition_id: oval:org.debian:def:30740608781805738597495789578309716344
title: CVE-2012-2330 nodejs
description:
The Update method in src/node_http_parser.cc in Node.js before 0.6.17 and 0.7 before 0.7.8 does not properly check the length of a string, which allows remote attackers to obtain sensitive information (request header contents) and possibly spoof HTTP headers via a zero length string.


definition_id: oval:org.debian:def:150977885098835812916859796252178482705
title: CVE-2012-2333 openssl
description:
Integer underflow in OpenSSL before 0.9.8x, 1.0.0 before 1.0.0j, and 1.0.1 before 1.0.1c, when TLS 1.1, TLS 1.2, or DTLS is used with CBC encryption, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted TLS packet that is not properly handled during a certain explicit IV calculation.


definition_id: oval:org.debian:def:43585567350297659320288320543940051844
title: CVE-2012-2334 libreoffice
description:
CVE-2012-2334 openoffice.org, libreoffice: Integer overflow leading to buffer overflow by processing invalid Escher graphics records length in the Powerpoint documents


definition_id: oval:org.debian:def:4506753334121726620699641778503463718
title: CVE-2012-2337 sudo
description:
sudo 1.6.x and 1.7.x before 1.7.9p1, and 1.8.x before 1.8.4p5, does not properly support configurations that use a netmask syntax, which allows local users to bypass intended command restrictions in opportunistic circumstances by executing a command on a host that has an IPv4 address.


definition_id: oval:org.debian:def:251313762155490754980676092383904116893
title: CVE-2012-2352 sympa
description:
The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3) do_arc_delete functions.


definition_id: oval:org.debian:def:258746074978373468217597542539640923432
title: CVE-2012-2369 pidgin-otr
description:
Format string vulnerability in the log_message_cb function in otr-plugin.c in the Off-the-Record Messaging (OTR) pidgin-otr plugin before 3.2.1 for Pidgin might allow remote attackers to execute arbitrary code via format string specifiers in data that generates a log message.


definition_id: oval:org.debian:def:229644624417155130355399947252515355115
title: CVE-2012-2370 gdk-pixbuf
description:
CVE-2012-2370 gdk-pixbuf: DoS (GLib error and application abort) due to an integer overflow in the XBM image file format loader


definition_id: oval:org.debian:def:64726592359419504826150466609147968504
title: CVE-2012-2372 linux
description:
The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.


definition_id: oval:org.debian:def:88999325001009046738353649718705024248
title: CVE-2012-2374 python-tornado
description:
CRLF injection vulnerability in the tornado.web.RequestHandler.set_header function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.


definition_id: oval:org.debian:def:282503828012310420603881425923134738676
title: CVE-2012-2385 mosh
description:
The terminal dispatcher in mosh before 1.2.1 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.


