# definitions

definition_id: oval:org.debian:def:284843961034630496713662451484540234238
title: CVE-2012-2388 strongswan
description:
The GMP Plugin in strongSwan 4.2.0 through 4.6.3 allows remote attackers to bypass authentication via a (1) empty or (2) zeroed RSA signature, aka "RSA signature verification vulnerability."


definition_id: oval:org.debian:def:338124902221776320601410937176184075299
title: CVE-2012-2392 wireshark
description:
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allows remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) ANSI MAP, (2) ASF, (3) IEEE 802.11, (4) IEEE 802.3, and (5) LTP dissectors.


definition_id: oval:org.debian:def:288324622735966131134171074104325449173
title: CVE-2012-2393 wireshark
description:
epan/dissectors/packet-diameter.c in the DIAMETER dissector in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 does not properly construct certain array data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet that triggers incorrect memory allocation.


definition_id: oval:org.debian:def:230798901607761158889259253991442991059
title: CVE-2012-2394 wireshark
description:
Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 on the SPARC and Itanium platforms does not properly perform data alignment for a certain structure member, which allows remote attackers to cause a denial of service (application crash) via a (1) ICMP or (2) ICMPv6 Echo Request packet.


definition_id: oval:org.debian:def:227056230623082230992107433922675967986
title: CVE-2012-2396 taglib
description:
VideoLAN VLC media player 2.0.1 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted MP4 file.


definition_id: oval:org.debian:def:108246385313614189475343469486985435847
title: CVE-2012-2399 wordpress
description:
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.


definition_id: oval:org.debian:def:311368202053774558964272730163631849369
title: CVE-2012-2400 wordpress
description:
Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.


definition_id: oval:org.debian:def:234049531411411424770614707011645523047
title: CVE-2012-2401 wordpress
description:
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.


definition_id: oval:org.debian:def:175369454056258297621579538240944135750
title: CVE-2012-2402 wordpress
description:
wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.


definition_id: oval:org.debian:def:114349953302313798979598189035852193127
title: CVE-2012-2403 wordpress
description:
wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


definition_id: oval:org.debian:def:104200742553816625024301510231663431570
title: CVE-2012-2404 wordpress
description:
wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


definition_id: oval:org.debian:def:217113985630249854672455091687276002662
title: CVE-2012-2414 asterisk
description:
main/manager.c in the Manager Interface in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4 does not properly enforce System class authorization requirements, which allows remote authenticated users to execute arbitrary commands via (1) the originate action in the MixMonitor application, (2) the SHELL and EVAL functions in the GetVar manager action, or (3) the SHELL and EVAL functions in the Status manager action.


definition_id: oval:org.debian:def:124626144649767568301939404217081456659
title: CVE-2012-2415 asterisk
description:
Heap-based buffer overflow in chan_skinny.c in the Skinny channel driver in Asterisk Open Source 1.6.2.x before 1.6.2.24, 1.8.x before 1.8.11.1, and 10.x before 10.3.1 allows remote authenticated users to cause a denial of service or possibly have unspecified other impact via a series of KEYPAD_BUTTON_MESSAGE events.


definition_id: oval:org.debian:def:214564274511755855294311096625218953788
title: CVE-2012-2416 asterisk
description:
chan_sip.c in the SIP channel driver in Asterisk Open Source 1.8.x before 1.8.11.1 and 10.x before 10.3.1 and Asterisk Business Edition C.3.x before C.3.7.4, when the trustrpid option is enabled, allows remote authenticated users to cause a denial of service (daemon crash) by sending a SIP UPDATE message that triggers a connected-line update attempt without an associated channel.


definition_id: oval:org.debian:def:136089399968611276217039174374032072465
title: CVE-2012-2417 python-crypto
description:
PyCrypto before 2.6 does not produce appropriate prime numbers when using an ElGamal scheme to generate a key, which reduces the signature space or public key space and makes it easier for attackers to conduct brute force attacks to obtain the private key.


definition_id: oval:org.debian:def:87715347257657923484975226337368602702
title: CVE-2012-2451 libconfig-inifiles-perl
description:
The Config::IniFiles module before 2.71 for Perl creates temporary files with predictable names, which allows local users to overwrite arbitrary files via a symlink attack.  NOTE: some of these details are obtained from third party information.  NOTE: it has been reported that this might only be exploitable by writing in the same directory as the .ini file. If this is the case, then this issue might not cross privilege boundaries.


definition_id: oval:org.debian:def:101031940312502463693008168647088860284
title: CVE-2012-2582 otrs2
description:
Multiple cross-site scripting (XSS) vulnerabilities in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.13, 3.0.x before 3.0.15, and 3.1.x before 3.1.9, and OTRS ITSM 2.1.x before 2.1.5, 3.0.x before 3.0.6, and 3.1.x before 3.1.6, allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with (1) a Cascading Style Sheets (CSS) expression property in the STYLE attribute of an arbitrary element or (2) UTF-7 text in an HTTP-EQUIV="CONTENT-TYPE" META element.


definition_id: oval:org.debian:def:153251965352898922423838831691164957871
title: CVE-2012-2625 xen
description:
The PyGrub boot loader in Xen unstable before changeset 25589:60f09d1ab1fe, 4.2.x, and 4.1.x allows local para-virtualized guest users to cause a denial of service (memory consumption) via a large (1) bzip2 or (2) lzma compressed kernel image.


definition_id: oval:org.debian:def:8094035818032566897888458425108329342
title: CVE-2012-2652 qemu
description:
The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.


definition_id: oval:org.debian:def:211478438723719035615716443638793963170
title: CVE-2012-2653 arpwatch
description:
arpwatch 2.1a15, as used by Red Hat, Debian, Fedora, and possibly others, does not properly drop supplementary groups, which might allow attackers to gain root privileges by leveraging other vulnerabilities in the daemon.


definition_id: oval:org.debian:def:15445993952375258600330085745971521830
title: CVE-2012-2654 nova
description:
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.


definition_id: oval:org.debian:def:140690628104222965140414870226679721801
title: CVE-2012-2657 unixodbc
description:
** DISPUTED **  Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option.  NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.


definition_id: oval:org.debian:def:267894507654965272750033343447039428243
title: CVE-2012-2658 unixodbc
description:
** DISPUTED **  Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option.  NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.


definition_id: oval:org.debian:def:24936713222100947879253364240698859082
title: CVE-2012-2665 libreoffice
description:
CVE-2012-2665 openoffice.org, libreoffice: Multiple heap-based buffer overflows in the XML manifest encryption handling code


definition_id: oval:org.debian:def:289812708365025063858667999164328195461
title: CVE-2012-2669 linux
description:
The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.4.5, does not validate the origin of Netlink messages, which allows local users to spoof Netlink communication via a crafted connector message.


definition_id: oval:org.debian:def:148345274906506357166653876119987702272
title: CVE-2012-2671 ruby-rack-cache
description:
The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache.


definition_id: oval:org.debian:def:16354770608916633742801649828574653382
title: CVE-2012-2672 mojarra
description:
Oracle Mojarra 2.1.7 does not properly "clean up" the FacesContext reference during startup, which allows local users to obtain context information an access resources from another WAR file by calling the FacesContext.getCurrentInstance function.


definition_id: oval:org.debian:def:24467967047069141285140119153858987617
title: CVE-2012-2673 libgc
description:
Multiple integer overflows in the (1) GC_generic_malloc and (2) calloc functions in malloc.c, and the (3) GC_generic_malloc_ignore_off_page function in mallocx.c in Boehm-Demers-Weiser GC (libgc) before 7.2 make it easier for context-dependent attackers to perform memory-related attacks such as buffer overflows via a large size value, which causes less memory to be allocated than expected.


definition_id: oval:org.debian:def:102742107183762052784620591237318190882
title: CVE-2012-2686 openssl
description:
crypto/evp/e_aes_cbc_hmac_sha1.c in the AES-NI functionality in the TLS 1.1 and 1.2 implementations in OpenSSL 1.0.1 before 1.0.1d allows remote attackers to cause a denial of service (application crash) via crafted CBC data.


definition_id: oval:org.debian:def:130082008022882647701619345474278375707
title: CVE-2012-2687 apache2
description:
Multiple cross-site scripting (XSS) vulnerabilities in the make_variant_list function in mod_negotiation.c in the mod_negotiation module in the Apache HTTP Server 2.4.x before 2.4.3, when the MultiViews option is enabled, allow remote attackers to inject arbitrary web script or HTML via a crafted filename that is not properly handled during construction of a variant list.


definition_id: oval:org.debian:def:274413697701580012706505793911129397856
title: CVE-2012-2690 libguestfs
description:
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users to obtain sensitive information.


definition_id: oval:org.debian:def:49868593420267826054468524942142913510
title: CVE-2012-2693 libvirt
description:
libvirt, possibly before 0.9.12, does not properly assign USB devices to virtual machines when multiple devices have the same vendor and product ID, which might cause the wrong device to be associated with a guest and might allow local users to access unintended USB devices.


definition_id: oval:org.debian:def:144164205530377094412922974753564413161
title: CVE-2012-2697 autofs
description:
Unspecified vulnerability in autofs, as used in Red Hat Enterprise Linux (RHEL) 5, allows local users to cause a denial of service (autofs crash and delayed mounts) or prevent "mount expiration" via unspecified vectors related to "using an LDAP-based automount map."


definition_id: oval:org.debian:def:47835326571693464259733597980052954781
title: CVE-2012-2698 mediawiki
description:
Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page.


definition_id: oval:org.debian:def:83044596186599732362108125157097544585
title: CVE-2012-2736 network-manager
description:
In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network.


definition_id: oval:org.debian:def:113128883286634366351542564677761787783
title: CVE-2012-2737 accountsservice
description:
The user_change_icon_file_authorized_cb function in /usr/libexec/accounts-daemon in AccountsService before 0.6.22 does not properly check the UID when copying an icon file to the system cache directory, which allows local users to read arbitrary files via a race condition.


definition_id: oval:org.debian:def:56050341797138944494415837263709843865
title: CVE-2012-2738 vte
description:
The VteTerminal in gnome-terminal (vte) before 0.32.2 allows remote authenticated users to cause a denial of service (long loop and CPU consumption) via an escape sequence with a large repeat count value.


definition_id: oval:org.debian:def:297572491557089287650905428341822562701
title: CVE-2012-2745 linux
description:
The copy_creds function in kernel/cred.c in the Linux kernel before 3.3.2 provides an invalid replacement session keyring to a child process, which allows local users to cause a denial of service (panic) via a crafted application that uses the fork system call.


definition_id: oval:org.debian:def:198503801291255372717648501087714246020
title: CVE-2012-2751 modsecurity-apache
description:
ModSecurity before 2.6.6, when used with PHP, does not properly handle single quotes not at the beginning of a request parameter value in the Content-Disposition field of a request with a multipart/form-data Content-Type header, which allows remote attackers to bypass filtering rules and perform other attacks such as cross-site scripting (XSS) attacks.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-5031.


definition_id: oval:org.debian:def:22473018114919446693984621011919932440
title: CVE-2012-2760 libapache2-mod-auth-openid
description:
mod_auth_openid before 0.7 for Apache uses world-readable permissions for /tmp/mod_auth_openid.db, which allows local users to obtain session ids.


definition_id: oval:org.debian:def:132538873250204140314249232877320524362
title: CVE-2012-2763 gimp
description:
Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.


definition_id: oval:org.debian:def:73853564898606089721008545298358278982
title: CVE-2012-2768 request-tracker4
description:
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the RTFM extension 2.0.4 through 2.4.3 for Best Practical Solutions RT allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:248816525913597926206063146820730274546
title: CVE-2012-2769 request-tracker4
description:
Multiple cross-site scripting (XSS) vulnerabilities in the topic administration page in the Extension::MobileUI extension before 1.02 for Best Practical Solutions RT 3.8.x and in Best Practical Solutions RT before 4.0.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:233662124409536172276173519971623223483
title: CVE-2012-2771 ffmpeg
description:
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2773, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.


definition_id: oval:org.debian:def:12331541101560383191698927946456579252
title: CVE-2012-2772 ffmpeg
description:
Unspecified vulnerability in the ff_rv34_decode_frame function in libavcodec/rv34.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing with frame threading."


definition_id: oval:org.debian:def:163429103060577188966029570549643098943
title: CVE-2012-2773 ffmpeg
description:
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2778, CVE-2012-2780, and CVE-2012-2781.


definition_id: oval:org.debian:def:295767626548947352402465032605103037600
title: CVE-2012-2775 ffmpeg
description:
Unspecified vulnerability in the read_var_block_data function in libavcodec/alsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to a large order and an "out of array write in quant_cof."


definition_id: oval:org.debian:def:18485364249844541695245752881680313749
title: CVE-2012-2776 ffmpeg
description:
Unspecified vulnerability in the decode_cell_data function in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.4 has unknown impact and attack vectors, related to an "out of picture write."


definition_id: oval:org.debian:def:47357704455393312399101425998531720280
title: CVE-2012-2777 ffmpeg
description:
Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than CVE-2012-2784.


definition_id: oval:org.debian:def:244979430419856254639080717779743364248
title: CVE-2012-2778 ffmpeg
description:
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2780, and CVE-2012-2781.


definition_id: oval:org.debian:def:252518945360439285739848341216994880043
title: CVE-2012-2779 ffmpeg
description:
Unspecified vulnerability in the decode_frame function in libavcodec/indeo5.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an invalid "gop header" and decoding in a "half initialized context."


definition_id: oval:org.debian:def:67926397258271143967966756854308482082
title: CVE-2012-2780 ffmpeg
description:
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2781.


definition_id: oval:org.debian:def:101535709475032247460559271800969485041
title: CVE-2012-2781 ffmpeg
description:
Unspecified vulnerability in FFmpeg before 0.10.3 has unknown impact and attack vectors, a different vulnerability than CVE-2012-2771, CVE-2012-2773, CVE-2012-2778, and CVE-2012-2780.


definition_id: oval:org.debian:def:129938763467679070205587608714221183269
title: CVE-2012-2783 ffmpeg
description:
Unspecified vulnerability in libavcodec/vp56.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to "freeing the returned frame."


definition_id: oval:org.debian:def:68983898375413114919520902127034625409
title: CVE-2012-2784 ffmpeg
description:
Unspecified vulnerability in the decode_pic function in libavcodec/cavsdec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to "width/height changing in CAVS," a different vulnerability than CVE-2012-2777.


definition_id: oval:org.debian:def:241737480555598010018801219539092615249
title: CVE-2012-2788 ffmpeg
description:
Unspecified vulnerability in the avi_read_packet function in libavformat/avidec.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to an "out of array read" when a "packet is shrunk."


definition_id: oval:org.debian:def:1679137773352452004389654076095576142
title: CVE-2012-2797 ffmpeg
description:
Unspecified vulnerability in the decode_frame_mp3on4 function in libavcodec/mpegaudiodec.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.5 has unknown impact and attack vectors related to a calculation that prevents a frame from being "large enough."


definition_id: oval:org.debian:def:12801384327112452931337071475090604456
title: CVE-2012-2801 ffmpeg
description:
Unspecified vulnerability in libavcodec/avs.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.4, has unknown impact and attack vectors, related to dimensions and "out of array writes."


definition_id: oval:org.debian:def:182998291098078559847034460252748870257
title: CVE-2012-2803 ffmpeg
description:
Double free vulnerability in the mpeg_decode_frame function in libavcodec/mpeg12.c in FFmpeg before 0.11, and Libav 0.7.x before 0.7.7 and 0.8.x before 0.8.5, has unknown impact and attack vectors, related to resetting the data size value.


definition_id: oval:org.debian:def:257414114228576195666073990625248548558
title: CVE-2012-2804 ffmpeg
description:
Unspecified vulnerability in libavcodec/indeo3.c in FFmpeg before 0.11 and Libav 0.8.x before 0.8.5 has unknown impact and attack vectors, related to "reallocation code" and the luma height and width.


definition_id: oval:org.debian:def:195413655256274197636672714405878633086
title: CVE-2012-2807 libxml2
description:
Multiple integer overflows in libxml2, as used in Google Chrome before 20.0.1132.43 and other products, on 64-bit Linux platforms allow remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:271847863347104154793014674523706885652
title: CVE-2012-2812 libexif
description:
The exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.


definition_id: oval:org.debian:def:276033066975010000207240152159782563331
title: CVE-2012-2813 libexif
description:
The exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.


definition_id: oval:org.debian:def:174344728651473503535501483825304582720
title: CVE-2012-2814 libexif
description:
Buffer overflow in the exif_entry_format_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.


definition_id: oval:org.debian:def:166315351044656373715733083203065321468
title: CVE-2012-2825 libxslt
description:
The XSL implementation in Google Chrome before 20.0.1132.43 allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.


definition_id: oval:org.debian:def:262296286522686470898236833553993594599
title: CVE-2012-2836 libexif
description:
The exif_data_load_data function in exif-data.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from process memory via crafted EXIF tags in an image.


definition_id: oval:org.debian:def:142211362177848350804702502327792988077
title: CVE-2012-2837 libexif
description:
The mnote_olympus_entry_get_value function in olympus/mnote-olympus-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service (divide-by-zero error) via an image with crafted EXIF tags that are not properly handled during the formatting of EXIF maker note tags.


definition_id: oval:org.debian:def:24333599300783538649869995426490934327
title: CVE-2012-2840 libexif
description:
Off-by-one error in the exif_convert_utf16_to_utf8 function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) before 0.6.21 allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted EXIF tags in an image.


definition_id: oval:org.debian:def:68541290704694530436510281981861161209
title: CVE-2012-2841 libexif
description:
Integer underflow in the exif_entry_get_value function in exif-entry.c in the EXIF Tag Parsing Library (aka libexif) 0.6.20 might allow remote attackers to execute arbitrary code via vectors involving a crafted buffer-size parameter during the formatting of an EXIF tag, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:282645403976440898487681149396756335627
title: CVE-2012-2845 exif
description:
Integer overflow in the jpeg_data_load_data function in jpeg-data.c in libjpeg in exif 0.6.20 allows remote attackers to cause a denial of service (buffer over-read and application crash) or obtain potentially sensitive information via a crafted JPEG file.


definition_id: oval:org.debian:def:57093069945264377174574960293412431394
title: CVE-2012-2864 mesa
description:
Mesa, as used in Google Chrome before 21.0.1183.0 on the Acer AC700, Cr-48, and Samsung Series 5 and 5 550 Chromebook platforms, and the Samsung Chromebox Series 3, allows remote attackers to execute arbitrary code via unspecified vectors that trigger an "array overflow."


definition_id: oval:org.debian:def:217623858543561941567572228038544385756
title: CVE-2012-2870 libxslt
description:
libxslt 1.1.26 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly manage memory, which might allow remote attackers to cause a denial of service (application crash) via a crafted XSLT expression that is not properly identified during XPath navigation, related to (1) the xsltCompileLocationPathPattern function in libxslt/pattern.c and (2) the xsltGenerateIdFunction function in libxslt/functions.c.


definition_id: oval:org.debian:def:224042245838072651347181738421332038927
title: CVE-2012-2871 libxslt
description:
libxml2 2.9.0-rc1 and earlier, as used in Google Chrome before 21.0.1180.89, does not properly support a cast of an unspecified variable during handling of XSL transforms, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document, related to the _xmlNs data structure in include/libxml/tree.h.


definition_id: oval:org.debian:def:8254714045104300890234829782759288927
title: CVE-2012-2893 libxslt
description:
Double free vulnerability in libxslt, as used in Google Chrome before 22.0.1229.79, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XSL transforms.


definition_id: oval:org.debian:def:41075247475698338598194277916279401585
title: CVE-2012-2921 feedparser
description:
Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.


definition_id: oval:org.debian:def:75755223545302781289793729549251544039
title: CVE-2012-2934 xen
description:
Xen 4.0, and 4.1, when running a 64-bit PV guest on "older" AMD CPUs, does not properly protect against a certain AMD processor bug, which allows local guest OS users to cause a denial of service (host hang) via sequential execution of instructions across a non-canonical boundary, a different vulnerability than CVE-2012-0217.


definition_id: oval:org.debian:def:102638962074821953439956861714831692991
title: CVE-2012-2942 haproxy
description:
Buffer overflow in the trash buffer in the header capture functionality in HAProxy before 1.4.21, when global.tune.bufsize is set to a value greater than the default and header rewriting is enabled, allows remote attackers to cause a denial of service and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:184754460926192109680130117497057861896
title: CVE-2012-2944 nut
description:
Buffer overflow in the addchar function in common/parseconf.c in upsd in Network UPS Tools (NUT) before 2.6.4 allows remote attackers to execute arbitrary code or cause a denial of service (electric-power outage) via a long string containing non-printable characters.


definition_id: oval:org.debian:def:166674141434737061454394957388566835305
title: CVE-2012-2947 asterisk
description:
chan_iax2.c in the IAX2 channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1, when a certain mohinterpret setting is enabled, allows remote attackers to cause a denial of service (daemon crash) by placing a call on hold.


definition_id: oval:org.debian:def:41120031777491444557801037434218165126
title: CVE-2012-2948 asterisk
description:
chan_skinny.c in the Skinny (aka SCCP) channel driver in Certified Asterisk 1.8.11-cert before 1.8.11-cert2 and Asterisk Open Source 1.8.x before 1.8.12.1 and 10.x before 10.4.1 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by closing a connection in off-hook mode.


definition_id: oval:org.debian:def:74141334303220017121943422545860131984
title: CVE-2012-3236 gimp
description:
fits-io.c in GIMP before 2.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed XTENSION header of a .fit file, as demonstrated using a long string.


definition_id: oval:org.debian:def:53093847360152829019766811814380222437
title: CVE-2012-3291 openconnect
description:
Heap-based buffer overflow in OpenConnect 3.18 allows remote servers to cause a denial of service via a crafted greeting banner.


definition_id: oval:org.debian:def:318879979399508933537934710466196586519
title: CVE-2012-3292 globus-gridftp-server
description:
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow remote attackers to gain privileges by logging in with a user that does not exist, which causes GridFTP to run as the last user in the password file.


definition_id: oval:org.debian:def:239451171854184276809025569576517088572
title: CVE-2012-3345 ioquake3
description:
ioquake3 before r2253 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/ioq3.pid temporary file.


definition_id: oval:org.debian:def:151091137788179181043231115785638943412
title: CVE-2012-3354 dokuwiki
description:
doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.


definition_id: oval:org.debian:def:293565579373520075479070258704341252526
title: CVE-2012-3355 rhythmbox
description:
(1) AlbumTab.py, (2) ArtistTab.py, (3) LinksTab.py, and (4) LyricsTab.py in the Context module in GNOME Rhythmbox 0.13.3 and earlier allows local users to execute arbitrary code via a symlink attack on a temporary HTML template file in the /tmp/context directory.


definition_id: oval:org.debian:def:177048437504169541851946069538676419530
title: CVE-2012-3356 viewvc
description:
The remote SVN views functionality (lib/vclib/svn/svn_ra.py) in ViewVC before 1.1.15 does not properly perform authorization, which allows remote attackers to bypass intended access restrictions via unspecified vectors.


definition_id: oval:org.debian:def:221135185445794013606370149206009504361
title: CVE-2012-3357 viewvc
description:
The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak."


definition_id: oval:org.debian:def:321321487863575497654549640769096979376
title: CVE-2012-3360 nova
description:
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.


definition_id: oval:org.debian:def:221250941329822972365729175474217533348
title: CVE-2012-3361 nova
description:
virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.


definition_id: oval:org.debian:def:185950199647866781843506825205093037229
title: CVE-2012-3364 linux
description:
Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields.


definition_id: oval:org.debian:def:178980840288938693139588318724502033220
title: CVE-2012-3366 bcfg2
description:
The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server).


definition_id: oval:org.debian:def:6434512220535383717207070673459149824
title: CVE-2012-3368 dtach
description:
Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach.


definition_id: oval:org.debian:def:120301021815964488342686234173880320083
title: CVE-2012-3371 nova
description:
The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.


definition_id: oval:org.debian:def:301600061946896965161216350520845302241
title: CVE-2012-3374 pidgin
description:
Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message.


definition_id: oval:org.debian:def:303649291433206549273274093507557547986
title: CVE-2012-3375 linux
description:
The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083.


definition_id: oval:org.debian:def:271519244466913499378442109821391748341
title: CVE-2012-3377 vlc
description:
Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file.


definition_id: oval:org.debian:def:171557449826196197916327326785760604234
title: CVE-2012-3378 at-spi2-atk
description:
The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2.


definition_id: oval:org.debian:def:86887274105637882536513324326743847871
title: CVE-2012-3380 nginx
description:
Directory traversal vulnerability in naxsi-ui/nx_extract.py in the Naxsi module before 0.46-1 for Nginx allows local users to read arbitrary files via unspecified vectors.


definition_id: oval:org.debian:def:215891636219362910909744932787126805675
title: CVE-2012-3382 mono
description:
Cross-site scripting (XSS) vulnerability in the ProcessRequest function in mcs/class/System.Web/System.Web/HttpForbiddenHandler.cs in Mono 2.10.8 and earlier allows remote attackers to inject arbitrary web script or HTML via a file with a crafted name and a forbidden extension, which is not properly handled in an error message.


definition_id: oval:org.debian:def:187832237004122696960123564661902664577
title: CVE-2012-3383 wordpress
description:
The map_meta_cap function in wp-includes/capabilities.php in WordPress 3.4.x before 3.4.2, when the multisite feature is enabled, does not properly assign the unfiltered_html capability, which allows remote authenticated users to bypass intended access restrictions and conduct cross-site scripting (XSS) attacks by leveraging the Administrator or Editor role and composing crafted text.


definition_id: oval:org.debian:def:216454018889516951105063612859204538990
title: CVE-2012-3384 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in the customizer in WordPress before 3.4.1 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.


definition_id: oval:org.debian:def:336221458058441963717301425524486650308
title: CVE-2012-3385 wordpress
description:
WordPress before 3.4.1 does not properly restrict access to post contents such as private or draft posts, which allows remote authors or contributors to obtain sensitive information via unknown vectors.


definition_id: oval:org.debian:def:127291859740313610238085520545664155591
title: CVE-2012-3386 automake1.11
description:
It was found that the distcheck rule in Automake-generated Makefiles made a directory world-writable when preparing source archives. If a malicious, local user could access this directory, they could execute arbitrary code with the privileges of the user running "make distcheck".


definition_id: oval:org.debian:def:235769578107858255841074427375840719772
title: CVE-2012-3400 linux
description:
Heap-based buffer overflow in the udf_load_logicalvol function in fs/udf/super.c in the Linux kernel before 3.4.5 allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted UDF filesystem.


definition_id: oval:org.debian:def:117073123592867525968862755913708629810
title: CVE-2012-3401 tiff
description:
CVE-2012-3401 libtiff (tiff2pdf): Heap-based buffer overflow due to improper initialization of T2P context struct pointer


definition_id: oval:org.debian:def:27232376521119208071964596932064022808
title: CVE-2012-3404 glibc
description:
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.12 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (stack corruption and crash) via a format string that uses positional parameters and many format specifiers.


definition_id: oval:org.debian:def:103547367264661713664709093527504529108
title: CVE-2012-3405 glibc
description:
The vfprintf function in stdio-common/vfprintf.c in libc in GNU C Library (aka glibc) 2.14 and other versions does not properly calculate a buffer length, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (segmentation fault and crash) via a format string with a large number of format specifiers that triggers "desynchronization within the buffer size handling," a different vulnerability than CVE-2012-3404.


definition_id: oval:org.debian:def:126273963690030676131856903758431071752
title: CVE-2012-3406 glibc
description:
The vfprintf function in stdio-common/vfprintf.c in GNU C Library (aka glibc) 2.5, 2.12, and probably other versions does not "properly restrict the use of" the alloca function when allocating the SPECS array, which allows context-dependent attackers to bypass the FORTIFY_SOURCE format-string protection mechanism and cause a denial of service (crash) or possibly execute arbitrary code via a crafted format string using positional parameters and a large number of format specifiers, a different vulnerability than CVE-2012-3404 and CVE-2012-3405.


definition_id: oval:org.debian:def:288091574705865751586646062799002573971
title: CVE-2012-3408 puppet
description:
lib/puppet/network/authstore.rb in Puppet before 2.7.18, and Puppet Enterprise before 2.5.2, supports use of IP addresses in certnames without warning of potential risks, which might allow remote attackers to spoof an agent by acquiring a previously used IP address.


definition_id: oval:org.debian:def:179188375390474308385175614004217469638
title: CVE-2012-3410 bash
description:
Stack-based buffer overflow in lib/sh/eaccess.c in GNU Bash before 4.2 patch 33 might allow local users to bypass intended restricted shell access via a long filename in /dev/fd, which is not properly handled when expanding the /dev/fd prefix.


definition_id: oval:org.debian:def:185098096779807527556577622655529613660
title: CVE-2012-3411 dnsmasq
description:
Dnsmasq before 2.63test1, when used with certain libvirt configurations, replies to requests from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via a spoofed DNS query.


definition_id: oval:org.debian:def:37147556887596488412581117038971440154
title: CVE-2012-3414 wordpress
description:
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.


definition_id: oval:org.debian:def:29052856502284030587396299736591407606
title: CVE-2012-3417 quota
description:
The good_client function in rquotad (rquota_svc.c) in Linux DiskQuota (aka quota) before 3.17 invokes the hosts_ctl function the first time without a host name, which might allow remote attackers to bypass TCP Wrappers rules in hosts.deny.


definition_id: oval:org.debian:def:230361088378550051892684522743235273775
title: CVE-2012-3418 pcp
description:
libpcp in Performance Co-Pilot (PCP) before 3.6.5 allows remote attackers to cause a denial of service and possibly execute arbitrary code via (1) a PDU with the numcreds field value greater than the number of actual elements to the __pmDecodeCreds function in p_creds.c; (2) the string byte number value to the __pmDecodeNameList function in p_pmns.c; (3) the numids value to the __pmDecodeIDList function in p_pmns.c; (4) unspecified vectors to the __pmDecodeProfile function in p_profile.c; the (5) status number value or (6) string number value to the __pmDecodeNameList function in p_pmns.c; (7) certain input to the __pmDecodeResult function in p_result.c; (8) the name length field (namelen) to the DecodeNameReq function in p_pmns.c; (9) a crafted PDU_FETCH request to the __pmDecodeFetch function in p_fetch.c; (10) the namelen field in the __pmDecodeInstanceReq function in p_instance.c; (11) the buflen field to the __pmDecodeText function in p_text.c; (12) PDU_INSTANCE packets to the __pmDecodeInstance in p_instance.c; or the (13) c_numpmid or (14) v_numval fields to the __pmDecodeLogControl function in p_lcontrol.c, which triggers integer overflows, heap-based buffer overflows, and/or buffer over-reads.


definition_id: oval:org.debian:def:219514752877532960025337543317227922908
title: CVE-2012-3419 pcp
description:
Performance Co-Pilot (PCP) before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments.


definition_id: oval:org.debian:def:77188629736721507992781352748276095118
title: CVE-2012-3420 pcp
description:
Multiple memory leaks in Performance Co-Pilot (PCP) before 3.6.5 allow remote attackers to cause a denial of service (memory consumption or daemon crash) via a large number of PDUs with (1) a crafted context number to the DoFetch function in pmcd/src/dofetch.c or (2) a negative type value to the __pmGetPDU function in libpcp/src/pdu.c.


definition_id: oval:org.debian:def:89007165842852591991738048735162504908
title: CVE-2012-3421 pcp
description:
The pduread function in pdu.c in libpcp in Performance Co-Pilot (PCP) before 3.6.5 does not properly time out connections, which allows remote attackers to cause a denial of service (pmcd hang) by sending individual bytes of a PDU separately, related to an "event-driven programming flaw."


definition_id: oval:org.debian:def:53599117317236644490514612472326534646
title: CVE-2012-3422 icedtea-web
description:
The getFirstInTableInstance function in the IcedTea-Web plugin before 1.2.1 returns an uninitialized pointer when the instance_to_id_map hash is empty, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted web page, which causes an uninitialized memory location to be read.


definition_id: oval:org.debian:def:77847401810224115598672491917655765082
title: CVE-2012-3423 icedtea-web
description:
The IcedTea-Web plugin before 1.2.1 does not properly handle NPVariant NPStrings without NUL terminators, which allows remote attackers to cause a denial of service (crash), obtain sensitive information from memory, or execute arbitrary code via a crafted Java applet.


definition_id: oval:org.debian:def:74775319195337855529108123344931533470
title: CVE-2012-3426 keystone
description:
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, which allows remote authenticated users to bypass intended authorization restrictions by (1) creating new tokens through token chaining, (2) leveraging possession of a token for a disabled user account, or (3) leveraging possession of a token for an account with a changed password.


definition_id: oval:org.debian:def:131781480708913189228794716087826345357
title: CVE-2012-3430 linux
description:
The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.


definition_id: oval:org.debian:def:247306349770236360923994386904897151981
title: CVE-2012-3432 xen
description:
The handle_mmio function in arch/x86/hvm/io.c in the MMIO operations emulator for Xen 3.3 and 4.x, when running an HVM guest, does not properly reset certain state information between emulation cycles, which allows local guest OS users to cause a denial of service (guest OS crash) via unspecified operations on MMIO regions.


definition_id: oval:org.debian:def:25606547706835091652238341984288073372
title: CVE-2012-3433 xen
description:
Xen 4.0 and 4.1 allows local HVM guest OS kernels to cause a denial of service (domain 0 VCPU hang and kernel panic) by modifying the physical address space in a way that triggers excessive shared page search time during the p2m teardown.


definition_id: oval:org.debian:def:128808219002880154391202938801094155998
title: CVE-2012-3435 zabbix
description:
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, allows remote attackers to execute arbitrary SQL commands via the itemid parameter.


definition_id: oval:org.debian:def:270425196517345076132291183640046532424
title: CVE-2012-3436 openttd
description:
OpenTTD 0.6.0 through 1.2.1 does not properly validate requests to clear a water tile, which allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a certain sequence of steps related to "the water/coast aspect of tiles which also have railtracks on one half."


definition_id: oval:org.debian:def:70525185694386894625367048937426802258
title: CVE-2012-3437 imagemagick
description:
The Magick_png_malloc function in coders/png.c in ImageMagick 6.7.8 and earlier does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.


definition_id: oval:org.debian:def:316565838890540251732540922315548465883
title: CVE-2012-3438 graphicsmagick
description:
The Magick_png_malloc function in coders/png.c in GraphicsMagick 6.7.8-6 does not use the proper variable type for the allocation size, which might allow remote attackers to cause a denial of service (crash) via a crafted PNG file that triggers incorrect memory allocation.


definition_id: oval:org.debian:def:113926401105325988162047650281386521950
title: CVE-2012-3442 python-django
description:
The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.


definition_id: oval:org.debian:def:268766423589261413365922429553730377821
title: CVE-2012-3443 python-django
description:
The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.


definition_id: oval:org.debian:def:203649136816049785339497651882542062201
title: CVE-2012-3444 python-django
description:
The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.


definition_id: oval:org.debian:def:277579853499140114280497453898680989407
title: CVE-2012-3445 libvirt
description:
The virTypedParameterArrayClear function in libvirt 0.9.13 does not properly handle virDomain* API calls with typed parameters, which might allow remote authenticated users to cause a denial of service (libvirtd crash) via an RPC command with nparams set to zero, which triggers an out-of-bounds read or a free of an invalid pointer.


definition_id: oval:org.debian:def:330040411227739356355481574355243232520
title: CVE-2012-3446 libcloud
description:
Apache Libcloud before 0.11.1 uses an incorrect regular expression during verification of whether the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a crafted certificate.


definition_id: oval:org.debian:def:84207838522049111106765563014169922999
title: CVE-2012-3447 nova
description:
virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.


definition_id: oval:org.debian:def:284618950978280665820130641594292394470
title: CVE-2012-3448 ganglia
description:
Unspecified vulnerability in Ganglia Web before 3.5.1 allows remote attackers to execute arbitrary PHP code via unknown attack vectors.


definition_id: oval:org.debian:def:5645720422811729058282275194905149200
title: CVE-2012-3449 openvswitch
description:
Open vSwitch 1.4.2 uses world writable permissions for (1) /var/lib/openvswitch/pki/controllerca/incoming/ and (2) /var/lib/openvswitch/pki/switchca/incoming/, which allows local users to delete and overwrite arbitrary files.


definition_id: oval:org.debian:def:18633325614759952062446063373745914636
title: CVE-2012-3453 logol
description:
logol 1.5.0 uses world writable permissions for the /var/lib/logol/results directory, which allows local users to delete or overwrite arbitrary files.


definition_id: oval:org.debian:def:174890046465342946942362569320706514739
title: CVE-2012-3456 calligra
description:
Heap-based buffer overflow in the read function in filters/words/msword-odf/wv2/src/styles.cpp in the Microsoft import filter in Calligra 2.4.3 and earlier allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted ODF style in an ODF document.  NOTE: this is the same vulnerability as CVE-2012-3455, but it was SPLIT by the CNA even though Calligra and KOffice share the same codebase.


definition_id: oval:org.debian:def:302165066932549564701711811035683439608
title: CVE-2012-3458 beaker
description:
Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.


definition_id: oval:org.debian:def:191924468049831516086846410450117761970
title: CVE-2012-3461 libotr
description:
The (1) otrl_base64_otr_decode function in src/b64.c; (2) otrl_proto_data_read_flags and (3) otrl_proto_accept_data functions in src/proto.c; and (4) decode function in toolkit/parse.c in libotr before 3.2.1 allocates a zero-length buffer when decoding a base64 string, which allows remote attackers to cause a denial of service (application crash) via a message with the value "?OTR:===.", which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:198044527003241505875900573267826340660
title: CVE-2012-3462 sssd
description:
A flaw was found in SSSD version 1.9.0. The SSSD's access-provider logic causes the result of the HBAC rule processing to be ignored in the event that the access-provider is also handling the setup of the user's SELinux user context.


definition_id: oval:org.debian:def:80331286786956758706081388130614066663
title: CVE-2012-3464 rails
description:
Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a ' (quote) character.


definition_id: oval:org.debian:def:301493910930829272441647390826314181168
title: CVE-2012-3465 rails
description:
Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.


definition_id: oval:org.debian:def:286779136808305441934010307548780622940
title: CVE-2012-3466 gnome-keyring
description:
GNOME gnome-keyring 3.4.0 through 3.4.1, when gpg-cache-method is set to "idle" or "timeout," does not properly limit the amount of time a passphrase is cached, which allows attackers to have an unspecified impact via unknown attack vectors.


definition_id: oval:org.debian:def:276268411605099341363949400972945378705
title: CVE-2012-3480 glibc
description:
CVE-2012-3480 glibc: Integer overflows, leading to stack-based buffer overflows in strto* related routines


definition_id: oval:org.debian:def:267522291774765010851479046918582275995
title: CVE-2012-3482 fetchmail
description:
Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:164337885073330208744793710024470020773
title: CVE-2012-3490 condor
description:
The (1) my_popenv_impl and (2) my_spawnv functions in src/condor_utils/my_popen.cpp and the (3) systemCommand function in condor_vm-gahp/vmgahp_common.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the return value of setuid calls, which might cause a subprocess to be created with root privileges and allow remote attackers to gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:289100861694830022983637078510144414004
title: CVE-2012-3491 condor
description:
src/condor_schedd.V6/schedd.cpp in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 does not properly check the permissions of jobs, which allows remote authenticated users to remove arbitrary idle jobs via unspecified vectors.


definition_id: oval:org.debian:def:254651926660803340393961807504007203496
title: CVE-2012-3492 condor
description:
The filesystem authentication (condor_io/condor_auth_fs.cpp) in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 uses authentication directories even when they have weak permissions, which allows remote attackers to impersonate users by renaming a user's authentication directory.


definition_id: oval:org.debian:def:23536508888355001422417403231554333311
title: CVE-2012-3493 condor
description:
The command_give_request_ad function in condor_startd.V6/command.cpp Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 allows remote attackers to obtain sensitive information, and possibly control or start arbitrary jobs, via a ClassAd request to the condor_startd port, which leaks the ClaimId.


definition_id: oval:org.debian:def:47308491886109996818957650246604401151
title: CVE-2012-3494 xen
description:
The set_debugreg hypercall in include/asm-x86/debugreg.h in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when running on x86-64 systems, allows local OS guest users to cause a denial of service (host crash) by writing to the reserved bits of the DR7 debug control register.


definition_id: oval:org.debian:def:275282109055637229596320876333690787285
title: CVE-2012-3495 xen
description:
The physdev_get_free_pirq hypercall in arch/x86/physdev.c in Xen 4.1.x and Citrix XenServer 6.0.2 and earlier uses the return value of the get_free_pirq function as an array index without checking that the return value indicates an error, which allows guest OS users to cause a denial of service (invalid memory write and host crash) and possibly gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:97139656946042270130926854699375901805
title: CVE-2012-3496 xen
description:
XENMEM_populate_physmap in Xen 4.0, 4.1, and 4.2, and Citrix XenServer 6.0.2 and earlier, when translating paging mode is not used, allows local PV OS guest kernels to cause a denial of service (BUG triggered and host crash) via invalid flags such as MEMF_populate_on_demand.


definition_id: oval:org.debian:def:3149420382564404209746091984656688873
title: CVE-2012-3497 xen
description:
(1) TMEMC_SAVE_GET_CLIENT_WEIGHT, (2) TMEMC_SAVE_GET_CLIENT_CAP, (3) TMEMC_SAVE_GET_CLIENT_FLAGS and (4) TMEMC_SAVE_END in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (NULL pointer dereference or memory corruption and host crash) or possibly have other unspecified impacts via a NULL client id.


definition_id: oval:org.debian:def:1393857194388857854155074354878884384
title: CVE-2012-3498 xen
description:
PHYSDEVOP_map_pirq in Xen 4.1 and 4.2 and Citrix XenServer 6.0.2 and earlier allows local HVM guest OS kernels to cause a denial of service (host crash) and possibly read hypervisor or guest memory via vectors related to a missing range check of map->index.


definition_id: oval:org.debian:def:72828596539850666657647523377958695863
title: CVE-2012-3499 apache2
description:
Multiple cross-site scripting (XSS) vulnerabilities in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving hostnames and URIs in the (1) mod_imagemap, (2) mod_info, (3) mod_ldap, (4) mod_proxy_ftp, and (5) mod_status modules.


definition_id: oval:org.debian:def:148564214366406939329066058730418054534
title: CVE-2012-3500 devscripts
description:
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.


definition_id: oval:org.debian:def:176776135824601913478463936866760751177
title: CVE-2012-3505 tinyproxy
description:
Tinyproxy 1.8.3 and earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via (1) a large number of headers or (2) a large number of forged headers that trigger hash collisions predictably.  bucket.


definition_id: oval:org.debian:def:171893828963298148286728233049763466915
title: CVE-2012-3508 roundcube
description:
Cross-site scripting (XSS) vulnerability in program/lib/washtml.php in Roundcube Webmail 0.8.0 allows remote attackers to inject arbitrary web script or HTML by using "javascript:" in an href attribute in the body of an HTML-formatted email.


definition_id: oval:org.debian:def:87679397883448530540849611489331734
title: CVE-2012-3509 binutils
description:
Multiple integer overflows in the (1) _objalloc_alloc function in objalloc.c and (2) objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service (crash) via vectors related to the "addition of CHUNK_HEADER_SIZE to the length," which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:229460629044809953912141997032064992196
title: CVE-2012-3512 munin
description:
Munin before 2.0.6 stores plugin state files that run as root in the same group-writable directory as non-root plugins, which allows local users to execute arbitrary code by replacing a state file, as demonstrated using the smart_ plugin.


definition_id: oval:org.debian:def:137299898873029433897233306813747075059
title: CVE-2012-3513 munin
description:
munin-cgi-graph in Munin before 2.0.6, when running as a CGI module under Apache, allows remote attackers to load new configurations and create files in arbitrary directories via the logdir command.


definition_id: oval:org.debian:def:307843883480540136959265852942642470840
title: CVE-2012-3514 xml-light
description:
OCaml Xml-Light Library before r234 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via unspecified vectors.


definition_id: oval:org.debian:def:64311708847807052118905600079018946348
title: CVE-2012-3517 tor
description:
Use-after-free vulnerability in dns.c in Tor before 0.2.2.38 might allow remote attackers to cause a denial of service (daemon crash) via vectors related to failed DNS requests.


definition_id: oval:org.debian:def:97584223962679251682793138682919611761
title: CVE-2012-3518 tor
description:
The networkstatus_parse_vote_from_string function in routerparse.c in Tor before 0.2.2.38 does not properly handle an invalid flavor name, which allows remote attackers to cause a denial of service (out-of-bounds read and daemon crash) via a crafted (1) vote document or (2) consensus document.


definition_id: oval:org.debian:def:203045052489725406139798516977904765986
title: CVE-2012-3519 tor
description:
routerlist.c in Tor before 0.2.2.38 uses a different amount of time for relay-list iteration depending on which relay is chosen, which might allow remote attackers to obtain sensitive information about relay selection via a timing side-channel attack.


definition_id: oval:org.debian:def:170612784302786682669331011026772345379
title: CVE-2012-3520 linux
description:
The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.


definition_id: oval:org.debian:def:96726223457767000847736776065285338074
title: CVE-2012-3521 geshi
description:
Multiple directory traversal vulnerabilities in the cssgen contrib module in GeSHi before 1.0.8.11 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) geshi-path or (2) geshi-lang-path parameter.


definition_id: oval:org.debian:def:254444308695554656926385769761427203996
title: CVE-2012-3523 inn2
description:
The STARTTLS implementation in nnrpd in INN before 2.5.3 does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.


definition_id: oval:org.debian:def:187876601835593206901678253868816870932
title: CVE-2012-3525 jabberd2
description:
s2s/out.c in jabberd2 2.2.16 and earlier does not verify that a request was made for an XMPP Server Dialback response, which allows remote XMPP servers to spoof domains via a (1) Verify Response or (2) Authorization Response.


definition_id: oval:org.debian:def:338670352238605842015116242298533452890
title: CVE-2012-3526 libapache2-mod-rpaf
description:
The reverse proxy add forward module (mod_rpaf) 0.5 and 0.6 for the Apache HTTP Server allows remote attackers to cause a denial of service (server or application crash) via multiple X-Forwarded-For headers in a request.


definition_id: oval:org.debian:def:296735823122216960202541197575415355915
title: CVE-2012-3540 horizon
description:
Open redirect vulnerability in views/auth_forms.py in OpenStack Dashboard (Horizon) Essex (2012.1) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the next parameter to auth/login/.  NOTE: this issue was originally assigned CVE-2012-3542 by mistake.


definition_id: oval:org.debian:def:135417611118460521746061088037543925019
title: CVE-2012-3542 keystone
description:
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API.  NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.


definition_id: oval:org.debian:def:120762031187528537335866663959608612326
title: CVE-2012-3547 freeradius
description:
Stack-based buffer overflow in the cbtls_verify function in FreeRADIUS 2.1.10 through 2.1.12, when using TLS-based EAP methods, allows remote attackers to cause a denial of service (server crash) and possibly execute arbitrary code via a long "not after" timestamp in a client certificate.


definition_id: oval:org.debian:def:57340410461009576296713096548325815103
title: CVE-2012-3548 wireshark
description:
The dissect_drda function in epan/dissectors/packet-drda.c in Wireshark 1.6.x through 1.6.10 and 1.8.x through 1.8.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a small value for a certain length field in a capture file.


definition_id: oval:org.debian:def:174885223950158649540589023295362315516
title: CVE-2012-3549 kfreebsd-10
description:
The SCTP implementation in FreeBSD 8.2 allows remote attackers to cause a denial of service (NULL pointer dereference and kernel panic) via a crafted ASCONF chunk.


definition_id: oval:org.debian:def:221910588001132554979208193312310873014
title: CVE-2012-3552 linux
description:
Race condition in the IP implementation in the Linux kernel before 3.0 might allow remote attackers to cause a denial of service (slab corruption and system crash) by sending packets to an application that sets socket options during the handling of network traffic.


definition_id: oval:org.debian:def:219931287042875172343883156813826434865
title: CVE-2012-3570 isc-dhcp
description:
Buffer overflow in ISC DHCP 4.2.x before 4.2.4-P1, when DHCPv6 mode is enabled, allows remote attackers to cause a denial of service (segmentation fault and daemon exit) via a crafted client identifier parameter.


definition_id: oval:org.debian:def:153848039803180097068244950972830995235
title: CVE-2012-3571 isc-dhcp
description:
ISC DHCP 4.1.2 through 4.2.4 and 4.1-ESV before 4.1-ESV-R6 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a malformed client identifier.


definition_id: oval:org.debian:def:281263031358427861544783817571432719209
title: CVE-2012-3587 apt
description:
APT 0.7.x before 0.7.25 and 0.8.x before 0.8.16, when using the apt-key net-update to import keyrings, relies on GnuPG argument order and does not check GPG subkeys, which might allow remote attackers to install Trojan horse packages via a man-in-the-middle (MITM) attack.


definition_id: oval:org.debian:def:173437986403083668993149895308649030751
title: CVE-2012-3812 asterisk
description:
Double free vulnerability in apps/app_voicemail.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones allows remote authenticated users to cause a denial of service (daemon crash) by establishing multiple voicemail sessions and accessing both the Urgent mailbox and the INBOX mailbox.


definition_id: oval:org.debian:def:15970360846863943101626892945776647836
title: CVE-2012-3817 bind9
description:
ISC BIND 9.4.x, 9.5.x, 9.6.x, and 9.7.x before 9.7.6-P2; 9.8.x before 9.8.3-P2; 9.9.x before 9.9.1-P2; and 9.6-ESV before 9.6-ESV-R7-P2, when DNSSEC validation is enabled, does not properly initialize the failing-query cache, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) by sending many queries.


definition_id: oval:org.debian:def:109549632921180686481786122600447728127
title: CVE-2012-3825 wireshark
description:
Multiple integer overflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (infinite loop) via vectors related to the (1) BACapp and (2) Bluetooth HCI dissectors, a different vulnerability than CVE-2012-2392.


definition_id: oval:org.debian:def:321821454845958603093432757208448154988
title: CVE-2012-3826 wireshark
description:
Multiple integer underflows in Wireshark 1.4.x before 1.4.13 and 1.6.x before 1.6.8 allow remote attackers to cause a denial of service (loop) via vectors related to the R3 dissector, a different vulnerability than CVE-2012-2392.


definition_id: oval:org.debian:def:290613128178162798414832738456992144563
title: CVE-2012-3863 asterisk
description:
channels/chan_sip.c in Asterisk Open Source 1.8.x before 1.8.13.1 and 10.x before 10.5.2, Asterisk Business Edition C.3.x before C.3.7.5, Certified Asterisk 1.8.11-certx before 1.8.11-cert4, and Asterisk Digiumphones 10.x.x-digiumphones before 10.5.2-digiumphones does not properly handle a provisional response to a SIP reINVITE request, which allows remote authenticated users to cause a denial of service (RTP port exhaustion) via sessions that lack final responses.


definition_id: oval:org.debian:def:7137604128148290646042192870847416120
title: CVE-2012-3864 puppet
description:
Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, allows remote authenticated users to read arbitrary files on the puppet master server by leveraging an arbitrary user's certificate and private key in a GET request.


definition_id: oval:org.debian:def:157003715243913026647641240240306686444
title: CVE-2012-3865 puppet
description:
Directory traversal vulnerability in lib/puppet/reports/store.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, when Delete is enabled in auth.conf, allows remote authenticated users to delete arbitrary files on the puppet master server via a .. (dot dot) in a node name.


definition_id: oval:org.debian:def:159425420818505015697556842144953981317
title: CVE-2012-3866 puppet
description:
lib/puppet/defaults.rb in Puppet 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, uses 0644 permissions for last_run_report.yaml, which allows local users to obtain sensitive configuration information by leveraging access to the puppet master server to read this file.


definition_id: oval:org.debian:def:200882631191375501181883317866621266435
title: CVE-2012-3867 puppet
description:
lib/puppet/ssl/certificate_authority.rb in Puppet before 2.6.17 and 2.7.x before 2.7.18, and Puppet Enterprise before 2.5.2, does not properly restrict the characters in the Common Name field of a Certificate Signing Request (CSR), which makes it easier for user-assisted remote attackers to trick administrators into signing a crafted agent certificate via ANSI control sequences.


definition_id: oval:org.debian:def:269515489163041305954018522014459007886
title: CVE-2012-3954 isc-dhcp
description:
Multiple memory leaks in ISC DHCP 4.1.x and 4.2.x before 4.2.4-P1 and 4.1-ESV before 4.1-ESV-R6 allow remote attackers to cause a denial of service (memory consumption) by sending many requests.


definition_id: oval:org.debian:def:85461271800963735725040425943601976865
title: CVE-2012-3955 isc-dhcp
description:
ISC DHCP 4.1.x before 4.1-ESV-R7 and 4.2.x before 4.2.4-P2 allows remote attackers to cause a denial of service (daemon crash) in opportunistic circumstances by establishing an IPv6 lease in an environment where the lease expiration time is later reduced.


definition_id: oval:org.debian:def:49419694793465186716070742039082305734
title: CVE-2012-4024 squashfs-tools
description:
Stack-based buffer overflow in the get_component function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted list file (aka a crafted file for the -ef option).  NOTE: probably in most cases, the list file is a trusted file constructed by the program's user; however, there are some realistic situations in which a list file would be obtained from an untrusted remote source.


definition_id: oval:org.debian:def:139025653462168846215661875907164209712
title: CVE-2012-4025 squashfs-tools
description:
Integer overflow in the queue_init function in unsquashfs.c in unsquashfs in Squashfs 4.2 and earlier allows remote attackers to execute arbitrary code via a crafted block_log field in the superblock of a .sqsh file, leading to a heap-based buffer overflow.


definition_id: oval:org.debian:def:137818341878936807439268504529895331084
title: CVE-2012-4037 transmission
description:
Multiple cross-site scripting (XSS) vulnerabilities in the web client in Transmission before 2.61 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) created by, or (3) name field in a torrent file.


definition_id: oval:org.debian:def:300122581351412342474407019418652174255
title: CVE-2012-4048 wireshark
description:
The PPP dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) via a crafted packet, as demonstrated by a usbmon dump.


definition_id: oval:org.debian:def:172057868607954460017922927121163279291
title: CVE-2012-4049 wireshark
description:
epan/dissectors/packet-nfs.c in the NFS dissector in Wireshark 1.4.x before 1.4.14, 1.6.x before 1.6.9, and 1.8.x before 1.8.1 allows remote attackers to cause a denial of service (loop and CPU consumption) via a crafted packet.


definition_id: oval:org.debian:def:93473756873033147520437727524085794783
title: CVE-2012-4225 nvidia-graphics-drivers
description:
NVIDIA UNIX graphics driver before 295.71 and before 304.32 allows local users to write to arbitrary physical memory locations and gain privileges by modifying the VGA window using /dev/nvidia0.


definition_id: oval:org.debian:def:34595332667944221758620958610902532665
title: CVE-2012-4233 libreoffice
description:
LibreOffice 3.5.x before 3.5.7.2 and 3.6.x before 3.6.1, and OpenOffice.org (OOo), allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted (1) odt file to vcllo.dll, (2) ODG (Drawing document) file to svxcorelo.dll, (3) PolyPolygon record in a .wmf (Window Meta File) file embedded in a ppt (PowerPoint) file to tllo.dll, or (4) xls (Excel) file to scfiltlo.dll.


definition_id: oval:org.debian:def:49998553105206135310685406145748404855
title: CVE-2012-4244 bind9
description:
ISC BIND 9.x before 9.7.6-P3, 9.8.x before 9.8.3-P3, 9.9.x before 9.9.1-P3, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P3 allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for a long resource record.


definition_id: oval:org.debian:def:166846952719066532783472881350800978740
title: CVE-2012-4277 smarty3
description:
Cross-site scripting (XSS) vulnerability in the smarty_function_html_options_optoutput function in distribution/libs/plugins/function.html_options.php in Smarty before 3.1.8 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:270042766865348804977086390222635054636
title: CVE-2012-4285 wireshark
description:
The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a zero-length message.


definition_id: oval:org.debian:def:152908323757768076694454562115162315967
title: CVE-2012-4286 wireshark
description:
The pcapng_read_packet_block function in wiretap/pcapng.c in the pcap-ng file parser in Wireshark 1.8.x before 1.8.2 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted pcap-ng file.


definition_id: oval:org.debian:def:85410941231657056632614493606461938078
title: CVE-2012-4287 wireshark
description:
epan/dissectors/packet-mongo.c in the MongoDB dissector in Wireshark 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a small value for a BSON document length.


definition_id: oval:org.debian:def:87060993922048257893518035922831862891
title: CVE-2012-4288 wireshark
description:
Integer overflow in the dissect_xtp_ecntl function in epan/dissectors/packet-xtp.c in the XTP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop or application crash) via a large value for a span length.


definition_id: oval:org.debian:def:146091733573346141437138955528570936962
title: CVE-2012-4289 wireshark
description:
epan/dissectors/packet-afp.c in the AFP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a large number of ACL entries.


definition_id: oval:org.debian:def:195554974034614174808222723073098619829
title: CVE-2012-4290 wireshark
description:
The CTDB dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (loop and CPU consumption) via a malformed packet.


definition_id: oval:org.debian:def:181178461346388298777669700664101137739
title: CVE-2012-4291 wireshark
description:
The CIP dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.


definition_id: oval:org.debian:def:336760601592972949637103270801538497477
title: CVE-2012-4292 wireshark
description:
The dissect_stun_message function in epan/dissectors/packet-stun.c in the STUN dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 does not properly interact with key-destruction behavior in a certain tree library, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:10613581326085524074492481878696598838
title: CVE-2012-4293 wireshark
description:
plugins/ethercat/packet-ecatmb.c in the EtherCAT Mailbox dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 does not properly handle certain integer fields, which allows remote attackers to cause a denial of service (application exit) via a malformed packet.


definition_id: oval:org.debian:def:102371499850150622884264395081854455308
title: CVE-2012-4294 wireshark
description:
Buffer overflow in the channelised_fill_sdh_g707_format function in epan/dissectors/packet-erf.c in the ERF dissector in Wireshark 1.8.x before 1.8.2 allows remote attackers to execute arbitrary code via a large speed (aka rate) value.


definition_id: oval:org.debian:def:296714630854230836797096968337115195106
title: CVE-2012-4295 wireshark
description:
Array index error in the channelised_fill_sdh_g707_format function in epan/dissectors/packet-erf.c in the ERF dissector in Wireshark 1.8.x before 1.8.2 might allow remote attackers to cause a denial of service (application crash) via a crafted speed (aka rate) value.


definition_id: oval:org.debian:def:60838762399009120176565662504816173873
title: CVE-2012-4296 wireshark
description:
Buffer overflow in epan/dissectors/packet-rtps2.c in the RTPS2 dissector in Wireshark 1.4.x before 1.4.15, 1.6.x before 1.6.10, and 1.8.x before 1.8.2 allows remote attackers to cause a denial of service (CPU consumption) via a malformed packet.


definition_id: oval:org.debian:def:279488551667458490545720918825470101888
title: CVE-2012-4297 wireshark
description:
Buffer overflow in the dissect_gsm_rlcmac_downlink function in epan/dissectors/packet-gsm_rlcmac.c in the GSM RLC MAC dissector in Wireshark 1.6.x before 1.6.10 and 1.8.x before 1.8.2 allows remote attackers to execute arbitrary code via a malformed packet.


definition_id: oval:org.debian:def:340069211909083387101120251316401968860
title: CVE-2012-4298 wireshark
description:
Integer signedness error in the vwr_read_rec_data_ethernet function in wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 1.8.x before 1.8.2 allows user-assisted remote attackers to execute arbitrary code via a crafted packet-trace file that triggers a buffer overflow.


definition_id: oval:org.debian:def:54569547414929639960540074269367126115
title: CVE-2012-4331 spip
description:
Multiple unspecified vulnerabilities in SPIP before 1.9.2.o, 2.0.x before 2.0.18, and 2.1.x before 2.1.13 have unknown impact and attack vectors that are not related to cross-site scripting (XSS), different vulnerabilities than CVE-2012-2151.


definition_id: oval:org.debian:def:110456485235836381034001867863615577597
title: CVE-2012-4377 mediawiki
description:
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.


definition_id: oval:org.debian:def:25872608836639490100117968848662407370
title: CVE-2012-4378 mediawiki
description:
Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.


definition_id: oval:org.debian:def:290745977577204549836434174218813108526
title: CVE-2012-4379 mediawiki
description:
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element.


definition_id: oval:org.debian:def:320719363970417751724807997469897459853
title: CVE-2012-4380 mediawiki
description:
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.


definition_id: oval:org.debian:def:104543416612163185372383582206615575284
title: CVE-2012-4381 mediawiki
description:
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors.


definition_id: oval:org.debian:def:81613171508011695043371931151336382515
title: CVE-2012-4382 mediawiki
description:
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.


definition_id: oval:org.debian:def:191827446969518405365436973968939079413
title: CVE-2012-4398 linux
description:
The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.


definition_id: oval:org.debian:def:43074667860064748426513657363039526294
title: CVE-2012-4404 moin
description:
security/__init__.py in MoinMoin 1.9 through 1.9.4 does not properly handle group names that contain virtual group names such as "All," "Known," or "Trusted," which allows remote authenticated users with virtual group membership to be treated as a member of the group.


definition_id: oval:org.debian:def:337729932091537448157293175623753125623
title: CVE-2012-4409 mcrypt
description:
Stack-based buffer overflow in the check_file_head function in extra.c in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to execute arbitrary code via an encrypted file with a crafted header containing long salt data that is not properly handled during decryption.


definition_id: oval:org.debian:def:28790426976978140976347150495501014151
title: CVE-2012-4411 xen
description:
The graphical console in Xen 4.0, 4.1 and 4.2 allows local OS guest administrators to obtain sensitive host resource information via the qemu monitor.  NOTE: this might be a duplicate of CVE-2007-0998.


definition_id: oval:org.debian:def:199896105589214389236765155950008342987
title: CVE-2012-4412 glibc
description:
Integer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:275557919705415463320198097404341531632
title: CVE-2012-4419 tor
description:
The compare_tor_addr_to_addr_policy function in or/policies.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.21-rc, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a zero-valued port field that is not properly handled during policy comparison.


definition_id: oval:org.debian:def:119970645383158495303257746326515103837
title: CVE-2012-4421 wordpress
description:
The create_post function in wp-includes/class-wp-atom-server.php in WordPress before 3.4.2 does not perform a capability check, which allows remote authenticated users to bypass intended access restrictions and publish new posts by leveraging the Contributor role and using the Atom Publishing Protocol (aka AtomPub) feature.


definition_id: oval:org.debian:def:30876987147835972495573254538242631396
title: CVE-2012-4422 wordpress
description:
wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveraging the Administrator role.


definition_id: oval:org.debian:def:162641946966481815364176568017239367353
title: CVE-2012-4423 libvirt
description:
The virNetServerProgramDispatchCall function in libvirt before 0.10.2 allows remote attackers to cause a denial of service (NULL pointer dereference and segmentation fault) via an RPC call with (1) an event as the RPC number or (2) an RPC number whose value is in a "gap" in the RPC dispatch table.


definition_id: oval:org.debian:def:179349549061147095728498979660004067616
title: CVE-2012-4424 glibc
description:
Stack-based buffer overflow in string/strcoll_l.c in the GNU C Library (aka glibc or libc6) 2.17 and earlier allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string that triggers a malloc failure and use of the alloca function.


definition_id: oval:org.debian:def:107894688245597718922797623490369650288
title: CVE-2012-4425 spice-gtk
description:
libgio, when used in setuid or other privileged programs in spice-gtk and possibly other products, allows local users to gain privileges and execute arbitrary code via the DBUS_SYSTEM_BUS_ADDRESS environment variable.  NOTE: it could be argued that this is a vulnerability in the applications that do not cleanse environment variables, not in libgio itself.


definition_id: oval:org.debian:def:17886834528864017117591494939267080619
title: CVE-2012-4426 mcrypt
description:
Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.


definition_id: oval:org.debian:def:88105127814104180328177740223868080997
title: CVE-2012-4429 vino
description:
Vino 2.28, 2.32, 3.4.2, and earlier allows remote attackers to read clipboard activity by listening on TCP port 5900.


definition_id: oval:org.debian:def:167396150442979355574333201929196691625
title: CVE-2012-4430 bacula
description:
The dump_resource function in dird/dird_conf.c in Bacula before 5.2.11 does not properly enforce ACL rules, which allows remote authenticated users to obtain resource dump information via unspecified vectors.


definition_id: oval:org.debian:def:122030525134781478393340533821587297435
title: CVE-2012-4433 gegl
description:
CVE-2012-4433 gegl: Integer overflow, leading to heap-based buffer overflow by parsing PPM image headers


definition_id: oval:org.debian:def:50832571855488863094750629698080455460
title: CVE-2012-4434 fwknop
description:
fwknop before 2.0.3 allow remote authenticated users to cause a denial of service (server crash) or possibly execute arbitrary code.


definition_id: oval:org.debian:def:309428877339497981890457051722164088968
title: CVE-2012-4435 fwknop
description:
fwknop before 2.0.3 does not properly validate IP addresses, which allows remote authenticated users to cause a denial of service (server crash) via a long IP address.


definition_id: oval:org.debian:def:66505621324705425915805309638541012197
title: CVE-2012-4436 fwknop
description:
Buffer overflow in the run_last_args function in client/fwknop.c in fwknop before 2.0.3, when processing --last, might allow local users to cause a denial of service (client crash) and possibly execute arbitrary code via many .fwknop.run arguments.


definition_id: oval:org.debian:def:214260004562220047576762757917680667604
title: CVE-2012-4437 smarty3
description:
Cross-site scripting (XSS) vulnerability in the SmartyException class in Smarty (aka smarty-php) before 3.1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger a Smarty exception.


definition_id: oval:org.debian:def:111075482061136680567673866038137862623
title: CVE-2012-4444 linux
description:
The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.


definition_id: oval:org.debian:def:248606402489810479302703316534382224108
title: CVE-2012-4445 wpa
description:
Heap-based buffer overflow in the eap_server_tls_process_fragment function in eap_server_tls_common.c in the EAP authentication server in hostapd 0.6 through 1.0 allows remote attackers to cause a denial of service (crash or abort) via a small "TLS Message Length" value in an EAP-TLS message with the "More Fragments" flag set.


definition_id: oval:org.debian:def:216630894541762381085923629983492014186
title: CVE-2012-4448 wordpress
description:
Cross-site request forgery (CSRF) vulnerability in wp-admin/index.php in WordPress 3.4.2 allows remote attackers to hijack the authentication of administrators for requests that modify an RSS URL via a dashboard_incoming_links edit action.


definition_id: oval:org.debian:def:277288639145031632623808209057041740627
title: CVE-2012-4450 389-ds-base
description:
389 Directory Server 1.2.10 does not properly update the ACL when a DN entry is moved by a modrdn operation, which allows remote authenticated users with certain permissions to bypass ACL restrictions and access the DN entry.


definition_id: oval:org.debian:def:278057521850928626478838212320934643174
title: CVE-2012-4453 dracut
description:
dracut.sh in dracut, as used in Red Hat Enterprise Linux 6, Fedora 16 and 17, and possibly other products, creates initramfs images with world-readable permissions, which might allow local users to obtain sensitive information.


definition_id: oval:org.debian:def:248625525212627146580922817151894105754
title: CVE-2012-4454 opencryptoki
description:
openCryptoki before 2.4.1, when using spinlocks, allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) .pkapi_xpk or (2) .pkcs11spinloc file in /tmp.


definition_id: oval:org.debian:def:88669011428624485931948618826769212844
title: CVE-2012-4455 opencryptoki
description:
openCryptoki 2.4.1 allows local users to create or set world-writable permissions on arbitrary files via a symlink attack on the (1) LCK..opencryptoki or (2) LCK..opencryptoki_stdll file in /var/lock/.


definition_id: oval:org.debian:def:304656805023002862232312888635413085228
title: CVE-2012-4457 keystone
description:
OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-3 does not properly handle authorization tokens for disabled tenants, which allows remote authenticated users to access the tenant's resources by requesting a token for the tenant.


definition_id: oval:org.debian:def:83488790325923551963251849135830263953
title: CVE-2012-4461 linux
description:
The KVM subsystem in the Linux kernel before 3.6.9, when running on hosts that use qemu userspace without XSAVE, allows local users to cause a denial of service (kernel OOPS) by using the KVM_SET_SREGS ioctl to set the X86_CR4_OSXSAVE bit in the guest cr4 register, then calling the KVM_RUN ioctl.


definition_id: oval:org.debian:def:95980310521067671691582927687405490042
title: CVE-2012-4463 mc
description:
Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.


definition_id: oval:org.debian:def:276679136801612474931415134212156401555
title: CVE-2012-4502 chrony
description:
Multiple integer overflows in pktlength.c in Chrony before 1.29 allow remote attackers to cause a denial of service (crash) via a crafted (1) REQ_SUBNETS_ACCESSED or (2) REQ_CLIENT_ACCESSES command request to the PKL_CommandLength function or crafted (3) RPY_SUBNETS_ACCESSED, (4) RPY_CLIENT_ACCESSES, (5) RPY_CLIENT_ACCESSES_BY_INDEX, or (6) RPY_MANUAL_LIST command reply to the PKL_ReplyLength function, which triggers an out-of-bounds read or buffer overflow.  NOTE: versions 1.27 and 1.28 do not require authentication to exploit.


definition_id: oval:org.debian:def:128035965415308517559756866134602504617
title: CVE-2012-4503 chrony
description:
cmdmon.c in Chrony before 1.29 allows remote attackers to obtain potentially sensitive information from stack memory via vectors related to (1) an invalid subnet in a RPY_SUBNETS_ACCESSED command to the handle_subnets_accessed function or (2) a RPY_CLIENT_ACCESSES command to the handle_client_accesses function when client logging is disabled, which causes uninitialized data to be included in a reply.


definition_id: oval:org.debian:def:51271913718775475747654682288109315951
title: CVE-2012-4505 libproxy
description:
Heap-based buffer overflow in the px_pac_reload function in lib/pac.c in libproxy 0.2.x and 0.3.x allows remote servers to have an unspecified impact via a crafted Content-Length size in an HTTP response header for a proxy.pac file request, a different vulnerability than CVE-2012-4504.


definition_id: oval:org.debian:def:126736982210277573141020394337147320338
title: CVE-2012-4507 claws-mail
description:
The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted email.


definition_id: oval:org.debian:def:63579229686526008812728068957951358865
title: CVE-2012-4508 linux
description:
Race condition in fs/ext4/extents.c in the Linux kernel before 3.4.16 allows local users to obtain sensitive information from a deleted file by reading an extent that was not properly marked as uninitialized.


definition_id: oval:org.debian:def:85480466774979632756493535311492913656
title: CVE-2012-4510 cups-pk-helper
description:
cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.


definition_id: oval:org.debian:def:9614735152699593660441861870809317411
title: CVE-2012-4520 python-django
description:
The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.


definition_id: oval:org.debian:def:307808892204047463145965628084178750446
title: CVE-2012-4523 radsecproxy
description:
radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.


definition_id: oval:org.debian:def:53295843104603698780754233863452713029
title: CVE-2012-4527 mcrypt
description:
Stack-based buffer overflow in mcrypt 2.6.8 and earlier allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long file name.  NOTE: it is not clear whether this is a vulnerability.


definition_id: oval:org.debian:def:53701661955444512680925989460730138530
title: CVE-2012-4528 modsecurity-apache
description:
The mod_security2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data.


definition_id: oval:org.debian:def:292970726738646943457338222474002616709
title: CVE-2012-4530 linux
description:
The load_script function in fs/binfmt_script.c in the Linux kernel before 3.7.2 does not properly handle recursion, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:32504241299176706617717740873388547093
title: CVE-2012-4533 viewvc
description:
Cross-site scripting (XSS) vulnerability in the "extra" details in the DiffSource._get_row function in lib/viewvc.py in ViewVC 1.0.x before 1.0.13 and 1.1.x before 1.1.16 allows remote authenticated users with repository commit access to inject arbitrary web script or HTML via the "function name" line.


definition_id: oval:org.debian:def:115690230619848137542828537732479814993
title: CVE-2012-4535 xen
description:
Xen 3.4 through 4.2, and possibly earlier versions, allows local guest OS administrators to cause a denial of service (Xen infinite loop and physical CPU consumption) by setting a VCPU with an "inappropriate deadline."


definition_id: oval:org.debian:def:194225509869349870494847722552919447014
title: CVE-2012-4536 xen
description:
The (1) domain_pirq_to_emuirq and (2) physdev_unmap_pirq functions in Xen 2.2 allows local guest OS administrators to cause a denial of service (Xen crash) via a crafted pirq value that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:64044498257541386615531670179224794565
title: CVE-2012-4537 xen
description:
Xen 3.4 through 4.2, and possibly earlier versions, does not properly synchronize the p2m and m2p tables when the set_p2m_entry function fails, which allows local HVM guest OS administrators to cause a denial of service (memory consumption and assertion failure), aka "Memory mapping failure DoS vulnerability."


definition_id: oval:org.debian:def:262030344662525692007443258647249478509
title: CVE-2012-4538 xen
description:
The HVMOP_pagetable_dying hypercall in Xen 4.0, 4.1, and 4.2 does not properly check the pagetable state when running on shadow pagetables, which allows a local HVM guest OS to cause a denial of service (hypervisor crash) via unspecified vectors.


definition_id: oval:org.debian:def:293042760468757317713057925195092779096
title: CVE-2012-4539 xen
description:
Xen 4.0 through 4.2, when running 32-bit x86 PV guests on 64-bit hypervisors, allows local guest OS administrators to cause a denial of service (infinite loop and hang or crash) via invalid arguments to GNTTABOP_get_status_frames, aka "Grant table hypercall infinite loop DoS vulnerability."


definition_id: oval:org.debian:def:274033904749900363942185002230706207789
title: CVE-2012-4540 icedtea-web
description:
Off-by-one error in the invoke function in IcedTeaScriptablePluginObject.cc in IcedTea-Web 1.1.x before 1.1.7, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.x before 1.4.1 allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly execute arbitrary code via a crafted webpage that triggers a heap-based buffer overflow, related to an error message and a "triggering event attached to applet." NOTE: the 1.4.x versions were originally associated with CVE-2013-4349, but that entry has been MERGED with this one.


definition_id: oval:org.debian:def:232485446760484300438293637737017714050
title: CVE-2012-4544 xen
description:
The PV domain builder in Xen 4.2 and earlier does not validate the size of the kernel or ramdisk (1) before or (2) after decompression, which allows local guest administrators to cause a denial of service (domain 0 memory consumption) via a crafted (a) kernel or (b) ramdisk.


definition_id: oval:org.debian:def:46175232703272632722678062100576907689
title: CVE-2012-4545 elinks
description:
The http_negotiate_create_context function in protocol/http/http_negotiate.c in ELinks 0.12 before 0.12pre6, when using HTTP Negotiate or GSS-Negotiate authentication, delegates user credentials through GSSAPI, which allows remote servers to authenticate as the client via the delegated credentials.


definition_id: oval:org.debian:def:201639603113876295425039850345078282836
title: CVE-2012-4552 plib
description:
Stack-based buffer overflow in the error function in ssg/ssgParser.cxx in PLIB 1.8.5 allows remote attackers to execute arbitrary code via a crafted 3d model file that triggers a long error message, as demonstrated by a .ase file.


definition_id: oval:org.debian:def:89488491086691068480196569433265772418
title: CVE-2012-4557 apache2
description:
The mod_proxy_ajp module in the Apache HTTP Server 2.2.12 through 2.2.21 places a worker node into an error state upon detection of a long request-processing time, which allows remote attackers to cause a denial of service (worker consumption) via an expensive request.


definition_id: oval:org.debian:def:300006863623057561013833866443114296458
title: CVE-2012-4558 apache2
description:
Multiple cross-site scripting (XSS) vulnerabilities in the balancer_handler function in the manager interface in mod_proxy_balancer.c in the mod_proxy_balancer module in the Apache HTTP Server 2.2.x before 2.2.24-dev and 2.4.x before 2.4.4 allow remote attackers to inject arbitrary web script or HTML via a crafted string.


definition_id: oval:org.debian:def:262379536463430006183617575961308493283
title: CVE-2012-4559 libssh
description:
Multiple double free vulnerabilities in the (1) agent_sign_data function in agent.c, (2) channel_request function in channels.c, (3) ssh_userauth_pubkey function in auth.c, (4) sftp_parse_attr_3 function in sftp.c, and (5) try_publickey_from_file function in keyfiles.c in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:321584657839125531177930869804166923782
title: CVE-2012-4560 libssh
description:
Multiple buffer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:143791079706228440354516664404638905968
title: CVE-2012-4561 libssh
description:
The (1) publickey_make_dss, (2) publickey_make_rsa, (3) signature_from_string, (4) ssh_do_sign, and (5) ssh_sign_session_id functions in keys.c in libssh before 0.5.3 free "an invalid pointer on an error path," which might allow remote attackers to cause a denial of service (crash) via unspecified vectors.


definition_id: oval:org.debian:def:236660852610315279352190904032756524070
title: CVE-2012-4562 libssh
description:
Multiple integer overflows in libssh before 0.5.3 allow remote attackers to cause a denial of service (infinite loop or crash) and possibly execute arbitrary code via unspecified vectors, which triggers a buffer overflow, infinite loop, or possibly some other unspecified vulnerabilities.


definition_id: oval:org.debian:def:316861984456232035019584727217003567392
title: CVE-2012-4564 tiff
description:
CVE-2012-4564 libtiff: Missing return value check in ppm2tiff leading to heap-buffer overflow when reading a tiff file


definition_id: oval:org.debian:def:112618976177821321210411432288622832819
title: CVE-2012-4565 linux
description:
The tcp_illinois_info function in net/ipv4/tcp_illinois.c in the Linux kernel before 3.4.19, when the net.ipv4.tcp_congestion_control illinois setting is enabled, allows local users to cause a denial of service (divide-by-zero error and OOPS) by reading TCP stats.


definition_id: oval:org.debian:def:274815984247688343716245740313713657376
title: CVE-2012-4566 radsecproxy
description:
The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523.


definition_id: oval:org.debian:def:111489361871666722914815713452693091443
title: CVE-2012-4570 php-letodms-core
description:
SQL injection vulnerability in LetoDMS_Core/Core/inc.ClassDMS.php in LetoDMS (formerly MyDMS) before 3.3.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:206643687733499032720592412147066101629
title: CVE-2012-4571 python-keyring
description:
Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.


definition_id: oval:org.debian:def:109689080864555437216521668458764142874
title: CVE-2012-4573 glance
description:
The v1 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request, a different vulnerability than CVE-2012-5482.


definition_id: oval:org.debian:def:148363999175093576766332436554291272719
title: CVE-2012-4575 pgbouncer
description:
The add_database function in objects.c in the pgbouncer pooler 1.5.2 for PostgreSQL allows remote attackers to cause a denial of service (daemon outage) via a long database name in a request.


definition_id: oval:org.debian:def:128495406833671782876099308471919503836
title: CVE-2012-4600 otrs2
description:
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.14, 3.0.x before 3.0.16, and 3.1.x before 3.1.10, when Firefox or Opera is used, allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with nested HTML tags.


definition_id: oval:org.debian:def:16721081607873107219406969717788815160
title: CVE-2012-4668 roundcube
description:
Cross-site scripting (XSS) vulnerability in Roundcube Webmail 0.8.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the signature in an email.


definition_id: oval:org.debian:def:29475848681181439847859305991179014976
title: CVE-2012-4678 munin
description:
munin-cgi-graph for Munin 2.0 rc4 does not delete temporary files, which allows remote attackers to cause a denial of service (disk consumption) via many requests to an image with unique parameters.


definition_id: oval:org.debian:def:40941109338495887395255688905300903292
title: CVE-2012-4730 request-tracker4
description:
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote authenticated users with ModifySelf or AdminUser privileges to inject arbitrary email headers and conduct phishing attacks or obtain sensitive information via unknown vectors.


definition_id: oval:org.debian:def:131312004489716779510770831594580438641
title: CVE-2012-4731 request-tracker4
description:
FAQ manager for Request Tracker (RTFM) before 2.4.5 does not properly check user rights, which allows remote authenticated users to create arbitrary articles in arbitrary classes via unknown vectors.


definition_id: oval:org.debian:def:35838010331701829330578283056561368768
title: CVE-2012-4732 request-tracker4
description:
Cross-site request forgery (CSRF) vulnerability in Request Tracker (RT) 3.8.12 and other versions before 3.8.15, and 4.0.6 and other versions before 4.0.8, allows remote attackers to hijack the authentication of users for requests that toggle ticket bookmarks.


definition_id: oval:org.debian:def:126363260942195763425558259218010282050
title: CVE-2012-4733 request-tracker4
description:
Request Tracker (RT) 4.x before 4.0.13 does not properly enforce the DeleteTicket and "custom lifecycle transition" permission, which allows remote authenticated users with the ModifyTicket permission to delete tickets via unspecified vectors.


definition_id: oval:org.debian:def:139445138492011760855528252373099430175
title: CVE-2012-4734 request-tracker4
description:
Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to conduct a "confused deputy" attack to bypass the CSRF warning protection mechanism and cause victims to "modify arbitrary state" via unknown vectors related to a crafted link.


definition_id: oval:org.debian:def:266193437882003301017852588137139307234
title: CVE-2012-4737 asterisk
description:
channels/chan_iax2.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.11-cert7, Asterisk Digiumphones 10.x.x-digiumphones before 10.7.1-digiumphones, and Asterisk Business Edition C.3.x before C.3.7.6 does not enforce ACL rules during certain uses of peer credentials, which allows remote authenticated users to bypass intended outbound-call restrictions by leveraging the availability of these credentials.


definition_id: oval:org.debian:def:138207125523520501655121713611339841804
title: CVE-2012-4751 otrs2
description:
Cross-site scripting (XSS) vulnerability in Open Ticket Request System (OTRS) Help Desk 2.4.x before 2.4.15, 3.0.x before 3.0.17, and 3.1.x before 3.1.11 allows remote attackers to inject arbitrary web script or HTML via an e-mail message body with whitespace before a javascript: URL in the SRC attribute of an element, as demonstrated by an IFRAME element.


definition_id: oval:org.debian:def:65111447758538075190188120911146908034
title: CVE-2012-4884 request-tracker4
description:
Argument injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.15 and 4.0.x before 4.0.8 allows remote attackers to create arbitrary files via unspecified vectors related to the GnuPG client.


definition_id: oval:org.debian:def:154368311896622853262952006157421682663
title: CVE-2012-4885 mediawiki
description:
The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function.


definition_id: oval:org.debian:def:176999513703254293832930116822925468399
title: CVE-2012-4922 tor
description:
The tor_timegm function in common/util.c in Tor before 0.2.2.39, and 0.2.3.x before 0.2.3.22-rc, does not properly validate time values, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed directory object, a different vulnerability than CVE-2012-4419.


definition_id: oval:org.debian:def:85127127780981820742544034264584511534
title: CVE-2012-4929 apache2
description:
The TLS protocol 1.2 and earlier, as used in Mozilla Firefox, Google Chrome, Qt, and other products, can encrypt compressed data without properly obfuscating the length of the unencrypted data, which allows man-in-the-middle attackers to obtain plaintext HTTP headers by observing length differences during a series of guesses in which a string in an HTTP request potentially matches an unknown string in an HTTP header, aka a "CRIME" attack.


definition_id: oval:org.debian:def:208783362985798642609547962129930987259
title: CVE-2012-5127 libwebp
description:
Integer overflow in Google Chrome before 23.0.1271.64 allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted WebP image.


definition_id: oval:org.debian:def:202673705285222699445623530194366145577
title: CVE-2012-5129 mesa
description:
Heap-based buffer overflow in the WebGL subsystem in Google Chrome OS before 23.0.1271.94 allows remote attackers to cause a denial of service (GPU process crash) or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:180785604721043260033444511871325940098
title: CVE-2012-5134 libxml2
description:
Heap-based buffer underflow in the xmlParseAttValueComplex function in parser.c in libxml2 2.9.0 and earlier, as used in Google Chrome before 23.0.1271.91 and other products, allows remote attackers to cause a denial of service or possibly execute arbitrary code via crafted entities in an XML document.


definition_id: oval:org.debian:def:143152865940555862454217634943204586534
title: CVE-2012-5150 ffmpeg
description:
Use-after-free vulnerability in Google Chrome before 24.0.1312.52 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving seek operations on video data.


definition_id: oval:org.debian:def:123185412895139646818465628666342103242
title: CVE-2012-5166 bind9
description:
ISC BIND 9.x before 9.7.6-P4, 9.8.x before 9.8.3-P4, 9.9.x before 9.9.1-P4, and 9.4-ESV and 9.6-ESV before 9.6-ESV-R7-P4 allows remote attackers to cause a denial of service (named daemon hang) via unspecified combinations of resource records.


definition_id: oval:org.debian:def:118366492442725708541377049132410623398
title: CVE-2012-5195 perl
description:
Heap-based buffer overflow in the Perl_repeatcpy function in util.c in Perl 5.12.x before 5.12.5, 5.14.x before 5.14.3, and 5.15.x before 15.15.5 allows context-dependent attackers to cause a denial of service (memory consumption and crash) or possibly execute arbitrary code via the 'x' string repeat operator.


definition_id: oval:org.debian:def:152461846508720581139033677176263028707
title: CVE-2012-5196 condor
description:
Multiple buffer overflows in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors.


definition_id: oval:org.debian:def:77331639618192121570509116587939286203
title: CVE-2012-5197 condor
description:
Multiple unspecified vulnerabilities in Condor 7.6.x before 7.6.10 and 7.8.x before 7.8.4 have unknown impact and attack vectors related to "error checking of system calls."


definition_id: oval:org.debian:def:316402566265943813773547150436128726139
title: CVE-2012-5237 wireshark
description:
The dissect_hsrp function in epan/dissectors/packet-hsrp.c in the HSRP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:20140085045880513470170256137145051860
title: CVE-2012-5238 wireshark
description:
epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.3 uses incorrect OUI data structures during the decoding of (1) PPP and (2) LCP data, which allows remote attackers to cause a denial of service (assertion failure and application exit) via a malformed packet.


definition_id: oval:org.debian:def:57942316846761076065571151930793793542
title: CVE-2012-5240 wireshark
description:
Buffer overflow in the dissect_tlv function in epan/dissectors/packet-ldp.c in the LDP dissector in Wireshark 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a malformed packet.


definition_id: oval:org.debian:def:257837956269543262800097015025384828064
title: CVE-2012-5340 mupdf
description:
SumatraPDF 2.1.1/MuPDF 1.0 allows remote attackers to cause an Integer Overflow in the lex_number() function via a corrupt PDF file.


definition_id: oval:org.debian:def:29480517098767944971974151393730323673
title: CVE-2012-5359 ffmpeg
description:
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted ASF file.


definition_id: oval:org.debian:def:75723114736622450578914924211890395736
title: CVE-2012-5360 ffmpeg
description:
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted QT file.


definition_id: oval:org.debian:def:132804143957981766724274080921698544530
title: CVE-2012-5361 ffmpeg
description:
Libavcodec in FFmpeg before 0.11 allows remote attackers to execute arbitrary code via a crafted WMV file.


definition_id: oval:org.debian:def:165683218511399615001172124899597073504
title: CVE-2012-5370 jruby
description:
JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.


definition_id: oval:org.debian:def:222251383984794826791085045997535339207
title: CVE-2012-5374 linux
description:
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (extended runtime of kernel code) by creating many different files whose names are associated with the same CRC32C hash value.


definition_id: oval:org.debian:def:268597194602540077787452041145394066075
title: CVE-2012-5375 linux
description:
The CRC32C feature in the Btrfs implementation in the Linux kernel before 3.8-rc1 allows local users to cause a denial of service (prevention of file creation) by leveraging the ability to write to a directory important to the victim, and creating a file with a crafted name that is associated with a specific CRC32C hash value.


definition_id: oval:org.debian:def:108220342431394405192794160709099028632
title: CVE-2012-5391 mediawiki
description:
Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id.


definition_id: oval:org.debian:def:131788862116169344108078480021016000322
title: CVE-2012-5468 bogofilter
description:
Heap-based buffer overflow in iconvert.c in the bogolexer component in Bogofilter before 1.2.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an email containing a base64 string that is decoded to incomplete multibyte characters.


definition_id: oval:org.debian:def:298928145378717818977814904526257037071
title: CVE-2012-5470 vlc
description:
libpng_plugin in VideoLAN VLC media player 2.0.3 allows remote attackers to cause a denial of service (application crash) via a crafted PNG file.


definition_id: oval:org.debian:def:114654548379386732713545656662800651708
title: CVE-2012-5474 horizon
description:
The file /etc/openstack-dashboard/local_settings within Red Hat OpenStack Platform 2.0 and RHOS Essex Release (python-django-horizon package before 2012.1.1) is world readable and exposes the secret key value.


definition_id: oval:org.debian:def:235324711766154531762525510099447678053
title: CVE-2012-5482 glance
description:
The v2 API in OpenStack Glance Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to delete arbitrary non-protected images via an image deletion request.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-4573.


definition_id: oval:org.debian:def:244107045672002624451587554855362486147
title: CVE-2012-5510 xen
description:
Xen 4.x, when downgrading the grant table version, does not properly remove the status page from the tracking list when freeing the page, which allows local guest OS administrators to cause a denial of service (hypervisor crash) via unspecified vectors.


definition_id: oval:org.debian:def:198557925718619910477979433999317835147
title: CVE-2012-5511 xen
description:
Stack-based buffer overflow in the dirty video RAM tracking functionality in Xen 3.4 through 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) via a large bitmap image.


definition_id: oval:org.debian:def:263395263890395020600806580716525038201
title: CVE-2012-5512 xen
description:
Array index error in the HVMOP_set_mem_access handler in Xen 4.1 allows local HVM guest OS administrators to cause a denial of service (crash) or obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:97952901395448418458502975006207260522
title: CVE-2012-5514 xen
description:
The guest_physmap_mark_populate_on_demand function in Xen 4.2 and earlier does not properly unlock the subject GFNs when checking if they are in use, which allows local guest HVM administrators to cause a denial of service (hang) via unspecified vectors.


definition_id: oval:org.debian:def:243604433245953882117340665909994650857
title: CVE-2012-5515 xen
description:
The (1) XENMEM_decrease_reservation, (2) XENMEM_populate_physmap, and (3) XENMEM_exchange hypercalls in Xen 4.2 and earlier allow local guest administrators to cause a denial of service (long loop and hang) via a crafted extent_order value.


definition_id: oval:org.debian:def:113283460108239838519230944664867165230
title: CVE-2012-5517 linux
description:
The online_pages function in mm/memory_hotplug.c in the Linux kernel before 3.6 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact in opportunistic circumstances by using memory that was hot-added by an administrator.


definition_id: oval:org.debian:def:71569797640551481650511543108585993887
title: CVE-2012-5524 gajim
description:
The _ssl_verify_callback function in tls_nb.py in Gajim before 0.15.3 does not properly verify SSL certificates, which allows remote attackers to conduct man-in-the-middle (MITM) attacks and spoof servers via an arbitrary certificate from a trusted CA.


definition_id: oval:org.debian:def:234641195436577211362664319032640951132
title: CVE-2012-5526 libcgi-pm-perl
description:
CGI.pm module before 3.63 for Perl does not properly escape newlines in (1) Set-Cookie or (2) P3P headers, which might allow remote attackers to inject arbitrary headers into responses from applications that use CGI.pm.


definition_id: oval:org.debian:def:160906536324674638832227336368351010027
title: CVE-2012-5530 pcp
description:
The (1) pcmd and (2) pmlogger init scripts in Performance Co-Pilot (PCP) before 3.6.10 allow local users to overwrite arbitrary files via a symlink attack on a /var/tmp/##### temporary file.


definition_id: oval:org.debian:def:215522847190610405392605644933338600749
title: CVE-2012-5533 lighttpd
description:
The http_request_split_value function in request.c in lighttpd before 1.4.32 allows remote attackers to cause a denial of service (infinite loop) via a request with a header containing an empty token, as demonstrated using the "Connection: TE,,Keep-Alive" header.


definition_id: oval:org.debian:def:51354195475945515238293359853371065870
title: CVE-2012-5534 weechat
description:
The hook_process function in the plugin API for WeeChat 0.3.0 through 0.3.9.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a command from a plugin, related to "shell expansion."


definition_id: oval:org.debian:def:17489438729670949415871228571220192994
title: CVE-2012-5571 keystone
description:
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed from a tenant, which allows remote authenticated users to bypass intended authorization restrictions by leveraging a token for the removed user role.


definition_id: oval:org.debian:def:52446186066166268032623995769888841616
title: CVE-2012-5572 libdancer-perl
description:
CRLF injection vulnerability in the cookie method (lib/Dancer/Cookie.pm) in Dancer before 1.3114 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a cookie name, a different vulnerability than CVE-2012-5526.


definition_id: oval:org.debian:def:128862367300426487120952985084167808374
title: CVE-2012-5573 tor
description:
The connection_edge_process_relay_cell function in or/relay.c in Tor before 0.2.3.25 maintains circuits even if an unexpected SENDME cell arrives, which might allow remote attackers to cause a denial of service (memory consumption or excessive cell reception rate) or bypass intended flow-control restrictions via a RELAY_COMMAND_SENDME command.


definition_id: oval:org.debian:def:317811339554229768426101161002368875893
title: CVE-2012-5578 python-keyring
description:
Python keyring has insecure permissions on new databases allowing world-readable files to be created


definition_id: oval:org.debian:def:110891924279778741391842895330742530075
title: CVE-2012-5580 libproxy
description:
Format string vulnerability in the print_proxies function in bin/proxy.c in libproxy 0.3.1 might allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in a proxy name, as demonstrated using the http_proxy environment variable or a PAC file.


definition_id: oval:org.debian:def:180640834515367334102567951401509484265
title: CVE-2012-5583 php-cas
description:
phpCAS before 1.3.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:208822543721180961550002386434284698572
title: CVE-2012-5619 sleuthkit
description:
The Sleuth Kit (TSK) 4.0.1 does not properly handle "." (dotfile) file system entries in FAT file systems and other file systems for which . is not a reserved name, which allows local users to hide activities it more difficult to conduct forensics activities, as demonstrated by Flame.


definition_id: oval:org.debian:def:38929087774768272274213817100325163864
title: CVE-2012-5624 qt4-x11
description:
The XMLHttpRequest object in Qt before 4.8.4 enables http redirection to the file scheme, which allows man-in-the-middle attackers to force the read of arbitrary local files and possibly obtain sensitive information via a file: URL to a QML application.


definition_id: oval:org.debian:def:195340560874360666430076676347107044883
title: CVE-2012-5630 libuser
description:
libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees.


definition_id: oval:org.debian:def:201917019686909667218682688296911380944
title: CVE-2012-5634 xen
description:
Xen 4.2.x, 4.1.x, and 4.0, when using Intel VT-d for PCI passthrough, does not properly configure VT-d when supporting a device that is behind a legacy PCI Bridge, which allows local guests to cause a denial of service to other guests by injecting an interrupt.


definition_id: oval:org.debian:def:60652859441624672654029094511935070198
title: CVE-2012-5635 glusterfs
description:
Multiple insecure temporary file creation flaws were found in Red Hat Storage. A local user on the Red Hat Storage server could use these flaws to cause arbitrary files to be overwritten as the root user via a symbolic link attack.


definition_id: oval:org.debian:def:44550134077825864886386852507308292352
title: CVE-2012-5638 sanlock
description:
The setup_logging function in log.h in SANLock uses world-writable permissions for /var/log/sanlock.log, which allows local users to overwrite the file content or bypass intended disk-quota restrictions via standard filesystem write operations.


definition_id: oval:org.debian:def:250294076453453889426977131680000472374
title: CVE-2012-5642 fail2ban
description:
server/action.py in Fail2ban before 0.8.8 does not properly handle the content of the matches tag, which might allow remote attackers to trigger unsafe behavior in a custom action file via unspecified symbols in this content.


definition_id: oval:org.debian:def:7101314764452146141033192753665485580
title: CVE-2012-5645 freeciv
description:
A denial of service flaw was found in the way the server component of Freeciv before 2.3.4 processed certain packets. A remote attacker could send a specially-crafted packet that, when processed would lead to memory exhaustion or excessive CPU consumption.


definition_id: oval:org.debian:def:54846694780880290419024773888090382591
title: CVE-2012-5656 inkscape
description:
The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.


definition_id: oval:org.debian:def:58123977888874724830678899618518335049
title: CVE-2012-5662 ibm-3270
description:
x3270 before 3.3.12ga12 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:313390834348137281719370774765876194508
title: CVE-2012-5667 grep
description:
Multiple integer overflows in GNU Grep before 2.11 might allow context-dependent attackers to execute arbitrary code via vectors involving a long input line that triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:107992638612950098206577771476880372519
title: CVE-2012-5668 freetype
description:
FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to BDF fonts and the improper handling of an "allocation error" in the bdf_free_font function.


definition_id: oval:org.debian:def:262702100796261965938512356496993832903
title: CVE-2012-5669 freetype
description:
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to BDF fonts and an incorrect calculation that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:108990087852244109858860865391282624826
title: CVE-2012-5670 freetype
description:
The _bdf_parse_glyphs function in FreeType before 2.4.11 allows context-dependent attackers to cause a denial of service (out-of-bounds write and crash) via vectors related to BDF fonts and an ENCODING field with a negative value.


definition_id: oval:org.debian:def:128835203007710587834484503938028172709
title: CVE-2012-5671 exim4
description:
Heap-based buffer overflow in the dkim_exim_query_dns_txt function in dkim.c in Exim 4.70 through 4.80, when DKIM support is enabled and acl_smtp_connect and acl_smtp_rcpt are not set to "warn control = dkim_disable_verify," allows remote attackers to execute arbitrary code via an email from a malicious DNS server.


definition_id: oval:org.debian:def:283046826085674530516637179517483716471
title: CVE-2012-5688 bind9
description:
ISC BIND 9.8.x before 9.8.4-P1 and 9.9.x before 9.9.2-P1, when DNS64 is enabled, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.


definition_id: oval:org.debian:def:154974800960005230050310519253239246733
title: CVE-2012-5689 bind9
description:
ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record.


definition_id: oval:org.debian:def:145403724496659991572328808272154186483
title: CVE-2012-5783 commons-httpclient
description:
Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:196090086065593087205657261924852890443
title: CVE-2012-5784 axis
description:
Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:54770318187884714211608981050641197670
title: CVE-2012-5825 tweepy
description:
Tweepy does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to use of the Python httplib library.


definition_id: oval:org.debian:def:265964688261925392048534438098437514979
title: CVE-2012-5854 weechat
description:
Heap-based buffer overflow in WeeChat 0.3.6 through 0.3.9 allows remote attackers to cause a denial of service (crash or hang) and possibly execute arbitrary code via crafted IRC colors that are not properly decoded.


definition_id: oval:org.debian:def:21912154393438048240078624843911188006
title: CVE-2012-5976 asterisk
description:
Multiple stack consumption vulnerabilities in Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones allow remote attackers to cause a denial of service (daemon crash) via TCP data using the (1) SIP, (2) HTTP, or (3) XMPP protocol.


definition_id: oval:org.debian:def:186277933848147544427031150162877352133
title: CVE-2012-5977 asterisk
description:
Asterisk Open Source 1.8.x before 1.8.19.1, 10.x before 10.11.1, and 11.x before 11.1.2; Certified Asterisk 1.8.11 before 1.8.11-cert10; and Asterisk Digiumphones 10.x-digiumphones before 10.11.1-digiumphones, when anonymous calls are enabled, allow remote attackers to cause a denial of service (resource consumption) by making anonymous calls from multiple sources and consequently adding many entries to the device state cache.


definition_id: oval:org.debian:def:224418220589891937559404210066246535613
title: CVE-2012-6030 xen
description:
The do_tmem_op function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (host crash) and possibly have other unspecified impacts via unspecified vectors related to "broken locking checks" in an "error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:320040313664806143568116734528803428034
title: CVE-2012-6031 xen
description:
The do_tmem_get function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (CPU hang and host crash) via unspecified vectors related to a spinlock being held in the "bad_copy error path." NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:184203085961049256707132705480901319741
title: CVE-2012-6032 xen
description:
Multiple integer overflows in the (1) tmh_copy_from_client and (2) tmh_copy_to_client functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 allow local guest OS users to cause a denial of service (memory corruption and host crash) via unspecified vectors. NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:225119614969814159346651809318746986473
title: CVE-2012-6033 xen
description:
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:123347276188045936624112529964453138673
title: CVE-2012-6034 xen
description:
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:273376569755128762838801725057312786635
title: CVE-2012-6035 xen
description:
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:157802819721546393189485378095825036632
title: CVE-2012-6036 xen
description:
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.


definition_id: oval:org.debian:def:37548041452380680891435855352807362264
title: CVE-2012-6052 wireshark
description:
Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.


definition_id: oval:org.debian:def:214110997709033685500612503890508750285
title: CVE-2012-6053 wireshark
description:
epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.


definition_id: oval:org.debian:def:209081601929940054924052476888136823753
title: CVE-2012-6054 wireshark
description:
The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite loop) via a packet that is neither IPv4 nor IPv6.


definition_id: oval:org.debian:def:304534538376111559344637012669061552375
title: CVE-2012-6055 wireshark
description:
epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.


definition_id: oval:org.debian:def:291179313341987253436652304303836336187
title: CVE-2012-6056 wireshark
description:
Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.


definition_id: oval:org.debian:def:131956345092083491030174977084122854910
title: CVE-2012-6057 wireshark
description:
The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:225520258650891687507841930471122897239
title: CVE-2012-6058 wireshark
description:
Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.


definition_id: oval:org.debian:def:140563913198897438524696140715675435385
title: CVE-2012-6059 wireshark
description:
The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:319789501699881238438539603807948242940
title: CVE-2012-6060 wireshark
description:
Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:224678060701572345456476989181229952943
title: CVE-2012-6061 wireshark
description:
The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.


definition_id: oval:org.debian:def:140674231730219531718486387718794771941
title: CVE-2012-6062 wireshark
description:
The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.


definition_id: oval:org.debian:def:281611095928104895981358883545492257133
title: CVE-2012-6063 libssh
description:
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.


definition_id: oval:org.debian:def:99208520418880106876167399117652433478
title: CVE-2012-6075 qemu
description:
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.


definition_id: oval:org.debian:def:73694470971414058724707566194666669536
title: CVE-2012-6076 inkscape
description:
Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users to obtain sensitive information, and possibly have other unspecified impacts.


definition_id: oval:org.debian:def:199132797417401759867311829736191648612
title: CVE-2012-6080 moin
description:
Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.


definition_id: oval:org.debian:def:21579907854688700728088061889898699824
title: CVE-2012-6081 moin
description:
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.


definition_id: oval:org.debian:def:150111321924795455579919787460775511597
title: CVE-2012-6082 moin
description:
Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.


definition_id: oval:org.debian:def:317839132243751716747628017473245853136
title: CVE-2012-6084 charybdis
description:
modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability negotiation during server handshakes, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request.


definition_id: oval:org.debian:def:251568283520327293175576483137958699155
title: CVE-2012-6086 zabbix
description:
libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:38206802843356561429050287716336123261
title: CVE-2012-6088 rpm
description:
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.


definition_id: oval:org.debian:def:34461571544996578372970341535251733683
title: CVE-2012-6089 swi-prolog
description:
Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.


definition_id: oval:org.debian:def:298717666516851397990602218279508197397
title: CVE-2012-6090 swi-prolog
description:
Multiple stack-based buffer overflows in the expand function in os/pl-glob.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.


definition_id: oval:org.debian:def:54311017370216552107823496151641558346
title: CVE-2012-6095 proftpd-dfsg
description:
ProFTPD before 1.3.5rc1, when using the UserOwner directive, allows local users to modify the ownership of arbitrary files via a race condition and a symlink attack on the (1) MKD or (2) XMKD commands.


definition_id: oval:org.debian:def:24784518928051155429402373141941613817
title: CVE-2012-6096 icinga
description:
Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host parameter) or (2) svc_description variable.


definition_id: oval:org.debian:def:51107844810689914096892196210602655787
title: CVE-2012-6110 bcron
description:
bcron-exec in bcron before 0.10 does not close file descriptors associated with temporary files when running a cron job, which allows local users to modify job files and send spam messages by accessing an open file descriptor.


definition_id: oval:org.debian:def:232492113840602829506284542605090887138
title: CVE-2012-6112 wordpress
description:
classes/GoogleSpell.php in the PHP Spellchecker (aka Google Spellchecker) addon before 2.0.6.1 for TinyMCE, as used in Moodle 2.1.x before 2.1.10, 2.2.x before 2.2.7, 2.3.x before 2.3.4, and 2.4.x before 2.4.1 and other products, does not properly handle control characters, which allows remote attackers to trigger arbitrary outbound HTTP requests via a crafted string.


definition_id: oval:org.debian:def:106674583674269961774098627796458078677
title: CVE-2012-6114 git-extras
description:
The git-changelog utility in git-extras 1.7.0 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/changelog or (2) /tmp/.git-effort.


definition_id: oval:org.debian:def:101320995442531193547984569672302575332
title: CVE-2012-6120 puppet
description:
Red Hat OpenStack Essex and Folsom creates the /var/log/puppet directory with world-readable permissions, which allows local users to obtain sensitive information such as Puppet log files.


definition_id: oval:org.debian:def:330563225425886737499340300619524766058
title: CVE-2012-6122 chicken
description:
Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value.


definition_id: oval:org.debian:def:173380461820973872288216638529713980570
title: CVE-2012-6123 chicken
description:
Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."


definition_id: oval:org.debian:def:152112619134105904262126809245330509401
title: CVE-2012-6124 chicken
description:
A casting error in Chicken before 4.8.0 on 64-bit platform caused the random number generator to return a constant value. NOTE: the vendor states "This function wasn't used for security purposes (and is advertised as being unsuitable)."


definition_id: oval:org.debian:def:183485912807023382439293990551386049861
title: CVE-2012-6125 chicken
description:
Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions.


definition_id: oval:org.debian:def:140577069862465458350428104740125171352
title: CVE-2012-6128 openconnect
description:
Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.


definition_id: oval:org.debian:def:182045502263051835568557732910053977527
title: CVE-2012-6129 transmission
description:
Stack-based buffer overflow in utp.cpp in libutp, as used in Transmission before 2.74 and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted "micro transport protocol packets."


definition_id: oval:org.debian:def:276610273379287302336966434127976422625
title: CVE-2012-6139 libxslt
description:
libxslt before 1.1.28 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an (1) empty match attribute in a XSL key to the xsltAddKey function in keys.c or (2) uninitialized variable to the xsltDocumentFunction function in functions.c.


definition_id: oval:org.debian:def:185280458818767766434410297837210043977
title: CVE-2012-6140 google-authenticator
description:
pam_google_authenticator.c in the PAM module in Google Authenticator before 1.0 requires user-readable permissions for the secret file, which allows local users to bypass intended access restrictions and discover a shared secret via standard filesystem operations, a different vulnerability than CVE-2013-0258.


definition_id: oval:org.debian:def:241812064949320060914501636472146623763
title: CVE-2012-6150 samba
description:
The winbind_name_list_to_sid_string_list function in nsswitch/pam_winbind.c in Samba through 4.1.2 handles invalid require_membership_of group names by accepting authentication by any user, which allows remote authenticated users to bypass intended access restrictions in opportunistic circumstances by leveraging an administrator's pam_winbind configuration-file mistake.


definition_id: oval:org.debian:def:225392177235350465177804762679942553937
title: CVE-2012-6151 net-snmp
description:
Net-SNMP 5.7.1 and earlier, when AgentX is registering to handle a MIB and processing GETNEXT requests, allows remote attackers to cause a denial of service (crash or infinite loop, CPU consumption, and hang) by causing the AgentX subagent to timeout.


definition_id: oval:org.debian:def:6761496447545856872173560089752266575
title: CVE-2012-6152 pidgin
description:
The Yahoo! protocol plugin in libpurple in Pidgin before 2.10.8 does not properly validate UTF-8 data, which allows remote attackers to cause a denial of service (application crash) via crafted byte sequences.


definition_id: oval:org.debian:def:189227441687213813962083933273859462670
title: CVE-2012-6153 commons-httpclient
description:
http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field.  NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.


definition_id: oval:org.debian:def:168361892535712783284560687662450910329
title: CVE-2012-6303 snack
description:
Heap-based buffer overflow in the GetWavHeader function in generic/jkSoundFile.c in the Snack Sound Toolkit, as used in WaveSurfer 1.8.8p4, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large chunk size in a WAV file.


definition_id: oval:org.debian:def:152826829904895425021904014609593100393
title: CVE-2012-6329 perl
description:
The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands via crafted input to an application that accepts translation strings from users, as demonstrated by the TWiki application before 5.1.3, and the Foswiki application 1.0.x through 1.0.10 and 1.1.x through 1.1.6.


definition_id: oval:org.debian:def:241314261505140229312906499973408145148
title: CVE-2012-6333 xen
description:
Multiple HVM control operations in Xen 3.4 through 4.2 allow local HVM guest OS administrators to cause a denial of service (physical CPU consumption) via a large input.


definition_id: oval:org.debian:def:37223646984082556455200876496763665350
title: CVE-2012-6426 lemonldap-ng
description:
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.


definition_id: oval:org.debian:def:285812940757030205116844441788010957800
title: CVE-2012-6459 connman
description:
ConnMan 1.3 on Tizen continues to list the bluetooth service after offline mode has been enabled, which might allow remote attackers to obtain sensitive information via Bluetooth packets.


definition_id: oval:org.debian:def:230777924648784063875993794370061955000
title: CVE-2012-6495 moin
description:
Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors.  NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.


definition_id: oval:org.debian:def:217854701136698221807118305495686555546
title: CVE-2012-6496 rails
description:
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.


definition_id: oval:org.debian:def:220722873543260678992787491819450060563
title: CVE-2012-6497 rails
description:
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.


definition_id: oval:org.debian:def:283593351997933875039515728979551737577
title: CVE-2012-6535 djvulibre
description:
DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted DjVu (aka .djv) file.


definition_id: oval:org.debian:def:137950477908117506035143081096763157773
title: CVE-2012-6536 linux
description:
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state.


definition_id: oval:org.debian:def:50172523985752363369019230888506614359
title: CVE-2012-6537 linux
description:
net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:8618967247028702855813468354494327080
title: CVE-2012-6538 linux
description:
The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:219172670386432674235460783768149411497
title: CVE-2012-6539 linux
description:
The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:63764916012761587391120476379266062977
title: CVE-2012-6540 linux
description:
The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:34755364633696730896878975100416593663
title: CVE-2012-6541 linux
description:
The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:315648743545409999040918142751353300291
title: CVE-2012-6542 linux
description:
The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.


definition_id: oval:org.debian:def:47730111675867004552193106894398695583
title: CVE-2012-6544 linux
description:
The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.


definition_id: oval:org.debian:def:135844581242025726312610298133413903716
title: CVE-2012-6545 linux
description:
The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.


definition_id: oval:org.debian:def:241451597442140014971537571044639942602
title: CVE-2012-6546 linux
description:
The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:238272782274369072709820984472511602341
title: CVE-2012-6547 linux
description:
The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:114865753046970570094033372547791987842
title: CVE-2012-6548 linux
description:
The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.


definition_id: oval:org.debian:def:61787162157562899418899206367621153562
title: CVE-2012-6549 linux
description:
The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.


definition_id: oval:org.debian:def:194196676791289125538405344027147958430
title: CVE-2012-6578 request-tracker4
description:
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled with a "Sign by default" queue configuration, uses a queue's key for signing, which might allow remote attackers to spoof messages by leveraging the lack of authentication semantics.


definition_id: oval:org.debian:def:38180137394570879101579246440176012395
title: CVE-2012-6579 request-tracker4
description:
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to configure encryption or signing for certain outbound e-mail, and possibly cause a denial of service (loss of e-mail readability), via an e-mail message to a queue's address.


definition_id: oval:org.debian:def:276646730378807643726906809038910345256
title: CVE-2012-6580 request-tracker4
description:
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, does not ensure that the UI labels unencrypted messages as unencrypted, which might make it easier for remote attackers to spoof details of a message's origin or interfere with encryption-policy auditing via an e-mail message to a queue's address.


definition_id: oval:org.debian:def:168718436507236869577121763132117128387
title: CVE-2012-6581 request-tracker4
description:
Best Practical Solutions RT 3.8.x before 3.8.15 and 4.0.x before 4.0.8, when GnuPG is enabled, allows remote attackers to bypass intended restrictions on reading keys in the product's keyring, and trigger outbound e-mail messages signed by an arbitrary stored secret key, by leveraging a UI e-mail signing privilege.


definition_id: oval:org.debian:def:210662631706965938673924102722686465254
title: CVE-2012-6607 augeas
description:
The transform_save function in transform.c in Augeas before 1.0.0 allows local users to overwrite arbitrary files and obtain sensitive information via a symlink attack on a .augsave file in a backup save action, a different vector than CVE-2012-0786.


definition_id: oval:org.debian:def:204046524998323026515269968672713698771
title: CVE-2012-6612 lucene-solr
description:
The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.


definition_id: oval:org.debian:def:175449416398061917592237949144491521704
title: CVE-2012-6618 ffmpeg
description:
The av_probe_input_buffer function in libavformat/utils.c in FFmpeg before 1.0.2, when running with certain -probesize values, allows remote attackers to cause a denial of service (crash) via a crafted MP3 file, possibly related to frame size or lack of sufficient "frames to estimate rate."


definition_id: oval:org.debian:def:98789070442053006559521285721900372879
title: CVE-2012-6620 php-horde-kronolith
description:
Multiple cross-site scripting (XSS) vulnerabilities in the (1) tasks and (2) search views in Horde Kronolith H4 before 3.0.17 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:293943622635580215548336569370443090666
title: CVE-2012-6633 wordpress
description:
Cross-site scripting (XSS) vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field.


definition_id: oval:org.debian:def:96101730949980552265940474230011790557
title: CVE-2012-6634 wordpress
description:
wp-admin/media-upload.php in WordPress before 3.3.3 allows remote attackers to obtain sensitive information or bypass intended media-attachment restrictions via a post_id value.


definition_id: oval:org.debian:def:56385052080991306082410350728527200736
title: CVE-2012-6635 wordpress
description:
wp-admin/includes/class-wp-posts-list-table.php in WordPress before 3.3.3 does not properly restrict excerpt-view access, which allows remote authenticated users to obtain sensitive information by visiting a draft.


definition_id: oval:org.debian:def:309584673422228737826814892190355057790
title: CVE-2012-6638 linux
description:
The tcp_rcv_state_process function in net/ipv4/tcp_input.c in the Linux kernel before 3.2.24 allows remote attackers to cause a denial of service (kernel resource consumption) via a flood of SYN+FIN TCP packets, a different vulnerability than CVE-2012-2663.


definition_id: oval:org.debian:def:190495635540012577132551023196209528803
title: CVE-2012-6639 cloud-init
description:
An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are submitted for EC2 instance data.


definition_id: oval:org.debian:def:315920964217512863230610324509285404503
title: CVE-2012-6640 php-horde-imp
description:
Cross-site scripting (XSS) vulnerability in Horde Internet Mail Program (IMP) before 5.0.22, as used in Horde Groupware Webmail Edition before 4.0.9, allows remote attackers to inject arbitrary web script or HTML via a crafted SVG image attachment, a different vulnerability than CVE-2012-5565.


definition_id: oval:org.debian:def:50038501084691914216756071859333498076
title: CVE-2012-6647 linux
description:
The futex_wait_requeue_pi function in kernel/futex.c in the Linux kernel before 3.5.1 does not ensure that calls have two different futex addresses, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted FUTEX_WAIT_REQUEUE_PI command.


definition_id: oval:org.debian:def:145193117665254368905393136167567379279
title: CVE-2012-6656 glibc
description:
iconvdata/ibm930.c in GNU C Library (aka glibc) before 2.16 allows context-dependent attackers to cause a denial of service (out-of-bounds read) via a multibyte character value of "0xffff" to the iconv function when converting IBM930 encoded data to UTF-8.


definition_id: oval:org.debian:def:63056097086880922025182977697414819619
title: CVE-2012-6657 linux
description:
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5.7 does not ensure that a keepalive action is associated with a stream socket, which allows local users to cause a denial of service (system crash) by leveraging the ability to create a raw socket.


definition_id: oval:org.debian:def:298408139103764449459559871779142083442
title: CVE-2012-6662 jqueryui
description:
Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo.


definition_id: oval:org.debian:def:244790058243495724467098951351657783207
title: CVE-2012-6684 ruby-redcloth
description:
Cross-site scripting (XSS) vulnerability in the RedCloth library 4.2.9 for Ruby and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript: URI.


definition_id: oval:org.debian:def:164076175082672919523069409161560890964
title: CVE-2012-6687 libfcgi
description:
FastCGI (aka fcgi and libfcgi) 2.4.0 allows remote attackers to cause a denial of service (segmentation fault and crash) via a large number of connections.


definition_id: oval:org.debian:def:311211952706740704677611495392892658015
title: CVE-2012-6689 linux
description:
The netlink_sendmsg function in net/netlink/af_netlink.c in the Linux kernel before 3.5.5 does not validate the dst_pid field, which allows local users to have an unspecified impact by spoofing Netlink messages.


definition_id: oval:org.debian:def:32184068520802473441622889515757118011
title: CVE-2012-6696 inspircd
description:
inspircd in Debian before 2.0.7 does not properly handle unsigned integers.  NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-1836.


definition_id: oval:org.debian:def:80644086284942752345336711515198270234
title: CVE-2012-6702 expat
description:
Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.


definition_id: oval:org.debian:def:253476233752274764693855033963496580295
title: CVE-2012-6703 linux
description:
Integer overflow in the snd_compr_allocate_buffer function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.


definition_id: oval:org.debian:def:311814117254376690760748242582984344060
title: CVE-2012-6704 linux
description:
The sock_setsockopt function in net/core/sock.c in the Linux kernel before 3.5 mishandles negative values of sk_sndbuf and sk_rcvbuf, which allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact by leveraging the CAP_NET_ADMIN capability for a crafted setsockopt system call with the (1) SO_SNDBUF or (2) SO_RCVBUF option.


definition_id: oval:org.debian:def:29994821171515260456291098044453696794
title: CVE-2012-6706 libclamunrar
description:
A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, as used in Sophos Anti-Virus Threat Detection Engine before 3.37.2 and other products, that can lead to arbitrary code execution. An integer overflow can be caused in DataSize+CurChannel. The result is a negative value of the "DestPos" variable, which allows the attacker to write out of bounds when setting Mem[DestPos].


definition_id: oval:org.debian:def:336350874095658812934332115398307146920
title: CVE-2012-6708 jquery
description:
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.


definition_id: oval:org.debian:def:237941631657082505027689590868720766310
title: CVE-2012-6711 bash
description:
A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable, are printed through the echo built-in function. A local attacker, who can provide data to print through the "echo -e" built-in function, may use this flaw to crash a script or execute code with the privileges of the bash process. This occurs because ansicstr() in lib/sh/strtrans.c mishandles u32cconv().


definition_id: oval:org.debian:def:217325561309899495224005113274738164900
title: CVE-2012-6712 linux
description:
In the Linux kernel before 3.4, a buffer overflow occurs in drivers/net/wireless/iwlwifi/iwl-agn-sta.c, which will cause at least memory corruption.


definition_id: oval:org.debian:def:242038294838532251981457723787899341736
title: CVE-2013-0131 nvidia-graphics-drivers
description:
Buffer overflow in the NVIDIA GPU driver before 304.88, 310.x before 310.44, and 313.x before 313.30 for the X Window System on UNIX, when NoScanout mode is enabled, allows remote authenticated users to execute arbitrary code via a large ARGB cursor.


definition_id: oval:org.debian:def:261816594796019442581030611364739673286
title: CVE-2013-0153 xen
description:
The AMD IOMMU support in Xen 4.2.x, 4.1.x, 3.3, and other versions, when using AMD-Vi for PCI passthrough, uses the same interrupt remapping table for the host and all guests, which allows guests to cause a denial of service by injecting an interrupt into other guests.


definition_id: oval:org.debian:def:244235579751052496891484907531499612264
title: CVE-2013-0155 rails
description:
Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.


definition_id: oval:org.debian:def:290552317733221737700062554061336387250
title: CVE-2013-0157 util-linux
description:
(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.


definition_id: oval:org.debian:def:96381060818365950007023008737699690624
title: CVE-2013-0160 linux
description:
The Linux kernel through 3.7.9 allows local users to obtain sensitive information about keystroke timing by using the inotify API on the /dev/ptmx device.


definition_id: oval:org.debian:def:290111506600189817976384638294840571343
title: CVE-2013-0166 openssl
description:
OpenSSL before 0.9.8y, 1.0.0 before 1.0.0k, and 1.0.1 before 1.0.1d does not properly perform signature verification for OCSP responses, which allows remote OCSP servers to cause a denial of service (NULL pointer dereference and application crash) via an invalid key.


definition_id: oval:org.debian:def:79154580133560928430518161603230446526
title: CVE-2013-0169 bouncycastle
description:
The TLS protocol 1.1 and 1.2 and the DTLS protocol 1.0 and 1.2, as used in OpenSSL, OpenJDK, PolarSSL, and other products, do not properly consider timing side-channel attacks on a MAC check requirement during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, aka the "Lucky Thirteen" issue.


definition_id: oval:org.debian:def:317958693186878199029357416390331425295
title: CVE-2013-0176 libssh
description:
The publickey_from_privatekey function in libssh before 0.5.4, when no algorithm is matched during negotiations, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a "Client: Diffie-Hellman Key Exchange Init" packet.


definition_id: oval:org.debian:def:321930848779609092667202697853019723311
title: CVE-2013-0179 memcached
description:
The process_bin_delete function in memcached.c in memcached 1.4.4 and other versions before 1.4.17, when running in verbose mode, allows remote attackers to cause a denial of service (segmentation fault) via a request to delete a key, which does not account for the lack of a null terminator in the key and triggers a buffer over-read when printing to stderr.


definition_id: oval:org.debian:def:243938138459424556764706484495914545397
title: CVE-2013-0189 squid
description:
cachemgr.cgi in Squid 3.1.x and 3.2.x, possibly 3.1.22, 3.2.4, and other versions, allows remote attackers to cause a denial of service (resource consumption) via a crafted request.  NOTE: this issue is due to an incorrect fix for CVE-2012-5643, possibly involving an incorrect order of arguments or incorrect comparison.


definition_id: oval:org.debian:def:276361140631635524215387372456752413416
title: CVE-2013-0190 linux
description:
The xen_failsafe_callback function in Xen for the Linux kernel 2.6.23 and other versions, when running a 32-bit PVOPS guest, allows local users to cause a denial of service (guest crash) by triggering an iret fault, leading to use of an incorrect stack pointer and stack corruption.


definition_id: oval:org.debian:def:54195836105147401602086150313267874706
title: CVE-2013-0198 dnsmasq
description:
Dnsmasq before 2.66test2, when used with certain libvirt configurations, replies to queries from prohibited interfaces, which allows remote attackers to cause a denial of service (traffic amplification) via spoofed TCP based DNS queries.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3411.


definition_id: oval:org.debian:def:139250825377271310665041249976700217693
title: CVE-2013-0208 nova
description:
The boot-from-volume feature in OpenStack Compute (Nova) Folsom and Essex, when using nova-volumes, allows remote authenticated users to boot from other users' volumes via a volume id in the block_device_mapping parameter.


definition_id: oval:org.debian:def:4109894609830472978538548223399866871
title: CVE-2013-0211 libarchive
description:
Integer signedness error in the archive_write_zip_data function in archive_write_set_format_zip.c in libarchive 3.1.2 and earlier, when running on 64-bit machines, allows context-dependent attackers to cause a denial of service (crash) via unspecified vectors, which triggers an improper conversion between unsigned and signed types, leading to a buffer overflow.


definition_id: oval:org.debian:def:72156200219333483219226688792609535261
title: CVE-2013-0213 samba
description:
The Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to conduct clickjacking attacks via a (1) FRAME or (2) IFRAME element.


definition_id: oval:org.debian:def:184740082761868684080674397050505432886
title: CVE-2013-0214 samba
description:
Cross-site request forgery (CSRF) vulnerability in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.21, 3.6.x before 3.6.12, and 4.x before 4.0.2 allows remote attackers to hijack the authentication of arbitrary users by leveraging knowledge of a password and composing requests that perform SWAT actions.


definition_id: oval:org.debian:def:97632404579396088211468632886038569843
title: CVE-2013-0216 linux
description:
The Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (loop) by triggering ring pointer corruption.


definition_id: oval:org.debian:def:189668405678139920362397236343656234755
title: CVE-2013-0217 linux
description:
Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.


definition_id: oval:org.debian:def:201422416127231396530752734022379868396
title: CVE-2013-0228 linux
description:
The xen_iret function in arch/x86/xen/xen-asm_32.S in the Linux kernel before 3.7.9 on 32-bit Xen paravirt_ops platforms does not properly handle an invalid value in the DS segment register, which allows guest OS users to gain guest OS privileges via a crafted application.


definition_id: oval:org.debian:def:110251175638027663140969483255186811259
title: CVE-2013-0231 linux
description:
The pciback_enable_msi function in the PCI backend driver (drivers/xen/pciback/conf_space_capability_msi.c) in Xen for the Linux kernel 2.6.18 and 3.8 allows guest OS users with PCI device access to cause a denial of service via a large number of kernel log messages. NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:211211755243503053301494426899605855269
title: CVE-2013-0233 ruby-devise
description:
Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts.


definition_id: oval:org.debian:def:167303432700353645994434582980792407564
title: CVE-2013-0235 wordpress
description:
The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.


definition_id: oval:org.debian:def:332325651010389118765067077320943550681
title: CVE-2013-0236 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.


definition_id: oval:org.debian:def:227190101925472937073500927850891757975
title: CVE-2013-0237 wordpress
description:
Cross-site scripting (XSS) vulnerability in Plupload.as in Moxiecode plupload before 1.5.5, as used in WordPress before 3.5.1 and other products, allows remote attackers to inject arbitrary web script or HTML via the id parameter.


definition_id: oval:org.debian:def:163252720670862035621813052378485437832
title: CVE-2013-0238 ircd-hybrid
description:
The try_parse_v4_netmask function in hostmask.c in IRCD-Hybrid before 8.0.6 does not properly validate masks, which allows remote attackers to cause a denial of service (crash) via a mask that causes a negative number to be parsed.


definition_id: oval:org.debian:def:294302252315356851421383981973223286036
title: CVE-2013-0240 gnome-online-accounts
description:
Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.


definition_id: oval:org.debian:def:203721968194482923882867188486063104478
title: CVE-2013-0241 xserver-xorg-video-qxl
description:
The QXL display driver in QXL Virtual GPU 0.1.0 allows local users to cause a denial of service (guest crash or hang) via a SPICE connection that prevents other threads from obtaining the qemu_mutex mutex.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:208698509446767837152850022416183189591
title: CVE-2013-0242 glibc
description:
Buffer overflow in the extend_buffers function in the regular expression matcher (posix/regexec.c) in glibc, possibly 2.17 and earlier, allows context-dependent attackers to cause a denial of service (memory corruption and crash) via crafted multibyte characters.


definition_id: oval:org.debian:def:294657523088997524865727580527751187210
title: CVE-2013-0247 keystone
description:
OpenStack Keystone Essex 2012.1.3 and earlier, Folsom 2012.2.3 and earlier, and Grizzly grizzly-2 and earlier allows remote attackers to cause a denial of service (disk consumption) via many invalid token requests that trigger excessive generation of log entries.


definition_id: oval:org.debian:def:92616123810271949423924821620564004192
title: CVE-2013-0248 libcommons-fileupload-java
description:
The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.


definition_id: oval:org.debian:def:72013706998039558906201475419793848640
title: CVE-2013-0249 curl
description:
Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.


definition_id: oval:org.debian:def:139776146336173832106677091931943147166
title: CVE-2013-0251 latd
description:
Stack-based buffer overflow in llogincircuit.cc in latd 1.25 through 1.30 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the llogin version.


definition_id: oval:org.debian:def:60296383829674103909201525138483028138
title: CVE-2013-0254 qt4-x11
description:
The QSharedMemory class in Qt 5.0.0, 4.8.x before 4.8.5, 4.7.x before 4.7.6, and other versions including 4.4.0 uses weak permissions (world-readable and world-writable) for shared memory segments, which allows local users to read sensitive information or modify critical program data, as demonstrated by reading a pixmap being sent to an X server.


definition_id: oval:org.debian:def:86301327763038662571039255961154675695
title: CVE-2013-0262 ruby-rack
description:
rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."


definition_id: oval:org.debian:def:64117366417972546435286119375318599463
title: CVE-2013-0263 ruby-rack
description:
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.


definition_id: oval:org.debian:def:224903039290923905308956994417140759169
title: CVE-2013-0265 xnbd
description:
The redirect_stderr function in xnbd_common.c in xnbd-server and xndb-wrapper in xNBD 0.1.0 allow local users to overwrite arbitrary files via a symlink attack on /tmp/xnbd.log.


definition_id: oval:org.debian:def:18185267645031852970982809676188373386
title: CVE-2013-0268 linux
description:
The msr_open function in arch/x86/kernel/msr.c in the Linux kernel before 3.7.6 allows local users to bypass intended capability restrictions by executing a crafted application as root, as demonstrated by msr32.c.


definition_id: oval:org.debian:def:130212615147713595926341296905464744980
title: CVE-2013-0269 ruby-json
description:
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."


definition_id: oval:org.debian:def:70902926849871761723644635367883375889
title: CVE-2013-0270 keystone
description:
OpenStack Keystone Grizzly before 2013.1, Folsom, and possibly earlier allows remote attackers to cause a denial of service (CPU and memory consumption) via a large HTTP request, as demonstrated by a long tenant_name when requesting a token.


definition_id: oval:org.debian:def:28669893432100822047797107078742858628
title: CVE-2013-0271 pidgin
description:
The MXit protocol plugin in libpurple in Pidgin before 2.10.7 might allow remote attackers to create or overwrite files via a crafted (1) mxit or (2) mxit/imagestrips pathname.


definition_id: oval:org.debian:def:111563117342197685950468106892669549941
title: CVE-2013-0272 pidgin
description:
Buffer overflow in http.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.7 allows remote servers to execute arbitrary code via a long HTTP header.


definition_id: oval:org.debian:def:313879754409240083525551694030938361767
title: CVE-2013-0273 pidgin
description:
sametime.c in the Sametime protocol plugin in libpurple in Pidgin before 2.10.7 does not properly terminate long user IDs, which allows remote servers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:266158074492402684963904739364393827409
title: CVE-2013-0274 pidgin
description:
upnp.c in libpurple in Pidgin before 2.10.7 does not properly terminate long strings in UPnP responses, which allows remote attackers to cause a denial of service (application crash) by leveraging access to the local network.


definition_id: oval:org.debian:def:37811343211748574713473627005330646169
title: CVE-2013-0275 ganglia
description:
Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


definition_id: oval:org.debian:def:254795987962710127424849291118313002377
title: CVE-2013-0276 rails
description:
ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.


definition_id: oval:org.debian:def:318440158221589651224386194006182989737
title: CVE-2013-0277 rails
description:
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.


definition_id: oval:org.debian:def:56778255222522848942733299565847921747
title: CVE-2013-0281 pacemaker
description:
Pacemaker 1.1.10, when remote Cluster Information Base (CIB) configuration or resource management is enabled, does not limit the duration of connections to the blocking sockets, which allows remote attackers to cause a denial of service (connection blocking).


definition_id: oval:org.debian:def:13495241122999446348191547890849739712
title: CVE-2013-0282 keystone
description:
OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restrictions.


definition_id: oval:org.debian:def:323854996478404838250479686736192454149
title: CVE-2013-0289 isync
description:
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:305032934076865751691273427016130689434
title: CVE-2013-0292 dbus-glib
description:
The dbus_g_proxy_manager_filter function in dbus-gproxy in Dbus-glib before 0.100.1 does not properly verify the sender of NameOwnerChanged signals, which allows local users to gain privileges via a spoofed signal.


definition_id: oval:org.debian:def:91128408211749407821256994951439062193
title: CVE-2013-0294 pyrad
description:
packet.py in pyrad before 2.1 uses weak random numbers to generate RADIUS authenticators and hash passwords, which makes it easier for remote attackers to obtain sensitive information via a brute force attack.


definition_id: oval:org.debian:def:208254233748657098405333860950608447575
title: CVE-2013-0296 pigz
description:
Race condition in pigz before 2.2.5 uses permissions derived from the umask when compressing a file before setting that file's permissions to match those of the original file, which might allow local users to bypass intended access permissions while compression is occurring.


definition_id: oval:org.debian:def:335391414811810918802142064832270610019
title: CVE-2013-0305 python-django
description:
The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.


definition_id: oval:org.debian:def:194589701219478281787498753400860326946
title: CVE-2013-0306 python-django
description:
The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.


definition_id: oval:org.debian:def:261673282372199254142485744346665198194
title: CVE-2013-0309 linux
description:
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.


definition_id: oval:org.debian:def:243371494232997170430124678217126751325
title: CVE-2013-0311 linux
description:
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.


definition_id: oval:org.debian:def:337983979236059267085634028239632293383
title: CVE-2013-0312 389-ds-base
description:
389 Directory Server before 1.3.0.4 allows remote attackers to cause a denial of service (crash) via a zero length LDAP control sequence.


definition_id: oval:org.debian:def:10849361218629691573183153405114592912
title: CVE-2013-0313 linux
description:
The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.


definition_id: oval:org.debian:def:269289168231793182990390258033412683548
title: CVE-2013-0334 bundler
description:
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.


definition_id: oval:org.debian:def:236557448130715700833778840477126092757
title: CVE-2013-0335 nova
description:
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.


definition_id: oval:org.debian:def:101952806030329178320849602712822832733
title: CVE-2013-0336 389-ds-base
description:
The ipapwd_chpwop function in daemons/ipa-slapi-plugins/ipa-pwd-extop/ipa_pwd_extop.c in the directory server (dirsrv) in FreeIPA before 3.2.0 allows remote attackers to cause a denial of service (crash) via a connection request without a username/dn, related to the 389 directory server.


definition_id: oval:org.debian:def:186511992504895451503521039334793559462
title: CVE-2013-0338 libxml2
description:
libxml2 2.9.0 and earlier allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, aka "internal entity expansion" with linear complexity.


definition_id: oval:org.debian:def:253603417192894780537986643433000641057
title: CVE-2013-0339 libxml2
description:
libxml2 through 2.9.1 does not properly handle external entities expansion unless an application developer uses the xmlSAX2ResolveEntity or xmlSetExternalEntityLoader function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue.  NOTE: it could be argued that because libxml2 already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed and each affected application would need its own CVE.


definition_id: oval:org.debian:def:135917293165378761488804701660246136045
title: CVE-2013-0343 linux
description:
The ipv6_create_tempaddr function in net/ipv6/addrconf.c in the Linux kernel through 3.8 does not properly handle problems with the generation of IPv6 temporary addresses, which allows remote attackers to cause a denial of service (excessive retries and address-generation outage), and consequently obtain sensitive information, via ICMPv6 Router Advertisement (RA) messages.


definition_id: oval:org.debian:def:34116047812163700294241816496481349868
title: CVE-2013-0347 webfs
description:
The Gentoo init script for webfs uses world-readable permissions for /var/log/webfsd.log, which allows local users to have unspecified impact by reading the file.


definition_id: oval:org.debian:def:263298791203312987997450854261906490933
title: CVE-2013-0349 linux
description:
The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.


definition_id: oval:org.debian:def:120229539226697014404064717646176903891
title: CVE-2013-0350 pktstat
description:
tmp_smtp.c in pktstat 1.8.5 allows local users to overwrite arbitrary files via a symlink attack on /tmp/smtp.log.


definition_id: oval:org.debian:def:199575279073133328242826162723800874798
title: CVE-2013-0454 samba
description:
The SMB2 implementation in Samba 3.6.x before 3.6.6, as used on the IBM Storwize V7000 Unified 1.3 before 1.3.2.3 and 1.4 before 1.4.0.1 and possibly other products, does not properly enforce CIFS share attributes, which allows remote authenticated users to (1) write to a read-only share; (2) trigger data-integrity problems related to the oplock, locking, coherency, or leases attribute; or (3) have an unspecified impact by leveraging incorrect handling of the browseable or "hide unreadable" parameter.


definition_id: oval:org.debian:def:185183285081865377664129992968207023352
title: CVE-2013-0722 ettercap
description:
Stack-based buffer overflow in the scan_load_hosts function in ec_scan.c in Ettercap 0.7.5.1 and earlier might allow local users to gain privileges via a Trojan horse hosts list containing a long line.


definition_id: oval:org.debian:def:303044086641394161525567358910245538752
title: CVE-2013-0791 nss
description:
The CERT_DecodeCertPackage function in Mozilla Network Security Services (NSS), as used in Mozilla Firefox before 20.0, Firefox ESR 17.x before 17.0.5, Thunderbird before 17.0.5, Thunderbird ESR 17.x before 17.0.5, SeaMonkey before 2.17, and other products, allows remote attackers to cause a denial of service (out-of-bounds read and memory corruption) via a crafted certificate.


definition_id: oval:org.debian:def:263359469896447156756227013425674502455
title: CVE-2013-0844 ffmpeg
description:
Off-by-one error in the adpcm_decode_frame function in libavcodec/adpcm.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via crafted DK4 data, which triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:42925657984692916935468466351268086837
title: CVE-2013-0846 ffmpeg
description:
Array index error in the qdm2_decode_super_block function in libavcodec/qdm2.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted QDM2 data, which triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:162459550419477944949608094098498100571
title: CVE-2013-0848 ffmpeg
description:
The decode_init function in libavcodec/huffyuv.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted width in huffyuv data with the predictor set to median and the colorspace set to YUV422P, which triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:321768872257045375790723260444332179934
title: CVE-2013-0849 ffmpeg
description:
The roq_decode_init function in libavcodec/roqvideodec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via a crafted (1) width or (2) height dimension that is not a multiple of sixteen in id RoQ video data.


definition_id: oval:org.debian:def:282948327067993075771173747745796362355
title: CVE-2013-0850 ffmpeg
description:
The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted H.264 data, which triggers an out-of-bounds array access.


definition_id: oval:org.debian:def:144990049820118349827683520402699247409
title: CVE-2013-0854 ffmpeg
description:
The mjpeg_decode_scan_progressive_ac function in libavcodec/mjpegdec.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted MJPEG data.


definition_id: oval:org.debian:def:331983487081436087428470868767083493841
title: CVE-2013-0856 ffmpeg
description:
The lpc_prediction function in libavcodec/alac.c in FFmpeg before 1.1 allows remote attackers to have an unspecified impact via crafted Apple Lossless Audio Codec (ALAC) data, related to a large nb_samples value.


definition_id: oval:org.debian:def:49247978360902631784196086666601264960
title: CVE-2013-0858 ffmpeg
description:
The atrac3_decode_init function in libavcodec/atrac3.c in FFmpeg before 1.0.4 allows remote attackers to have an unspecified impact via ATRAC3 data with the joint stereo coding mode set and fewer than two channels.


definition_id: oval:org.debian:def:37373481577499576868662957499472543632
title: CVE-2013-0860 ffmpeg
description:
The ff_er_frame_end function in libavcodec/error_resilience.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.1 does not properly verify that a frame is fully initialized, which allows remote attackers to trigger a NULL pointer dereference via crafted picture data.


definition_id: oval:org.debian:def:20916464257092714345764142437150819216
title: CVE-2013-0865 ffmpeg
description:
The vqa_decode_chunk function in libavcodec/vqavideo.c in FFmpeg before 1.0.4 and 1.1.x before 1.1.2 allows remote attackers to have an unspecified impact via a large (1) cbp0 or (2) cbpz chunk in Westwood Studios VQA Video file, which triggers an out-of-bounds write.


definition_id: oval:org.debian:def:256921928739446478759178008794704404442
title: CVE-2013-0867 ffmpeg
description:
The decode_slice_header function in libavcodec/h264.c in FFmpeg before 1.1.2 does not properly check when the pixel format changes, which allows remote attackers to have unspecified impact via crafted H.264 video data, related to an out-of-bounds array access.


definition_id: oval:org.debian:def:151646924846790210109172829540645457232
title: CVE-2013-0868 ffmpeg
description:
libavcodec/huffyuvdec.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted Huffyuv data, related to an out-of-bounds write and (1) unchecked return codes from the init_vlc function and (2) "len==0 cases."


definition_id: oval:org.debian:def:290513042727038289040566142595093436192
title: CVE-2013-0869 ffmpeg
description:
The field_end function in libavcodec/h264.c in FFmpeg before 1.1.2 allows remote attackers to have an unspecified impact via crafted H.264 data, related to an SPS and slice mismatch and an out-of-bounds array access.


definition_id: oval:org.debian:def:194293537128903846379828596102393639807
title: CVE-2013-0871 linux
description:
Race condition in the ptrace functionality in the Linux kernel before 3.7.5 allows local users to gain privileges via a PTRACE_SETREGS ptrace system call in a crafted application, as demonstrated by ptrace_death.


definition_id: oval:org.debian:def:297252656770509801154203869453916409352
title: CVE-2013-0873 ffmpeg
description:
The read_header function in libavcodec/shorten.c in FFmpeg before 1.1.3 allows remote attackers to have an unspecified impact via an invalid channel count, related to "freeing invalid addresses."


definition_id: oval:org.debian:def:87718493717199406243294965064496430823
title: CVE-2013-0894 ffmpeg
description:
Buffer overflow in the vorbis_parse_setup_hdr_floors function in the Vorbis decoder in vorbisdec.c in libavcodec in FFmpeg through 1.1.3, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (divide-by-zero error or out-of-bounds array access) or possibly have unspecified other impact via vectors involving a zero value for a bark map size.


definition_id: oval:org.debian:def:317447683029209630486280583100373858402
title: CVE-2013-0899 opus
description:
Integer overflow in the padding implementation in the opus_packet_parse_impl function in src/opus_decoder.c in Opus before 1.0.2, as used in Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a long packet.


definition_id: oval:org.debian:def:160466621133893973204488584910285084793
title: CVE-2013-0900 icu
description:
Race condition in the International Components for Unicode (ICU) functionality in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:186362496751800332509599669691874632601
title: CVE-2013-0913 linux
description:
Integer overflow in drivers/gpu/drm/i915/i915_gem_execbuffer.c in the i915 driver in the Direct Rendering Manager (DRM) subsystem in the Linux kernel through 3.8.3, as used in Google Chrome OS before 25.0.1364.173 and other products, allows local users to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted application that triggers many relocation copies, and potentially leads to a race condition.


definition_id: oval:org.debian:def:288076900019457426418873906782743874378
title: CVE-2013-0914 linux
description:
The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.


definition_id: oval:org.debian:def:142296509972650024136614115181160049239
title: CVE-2013-1048 apache2
description:
The Debian apache2ctl script in the apache2 package squeeze before 2.2.16-6+squeeze11, wheezy before 2.2.22-13, and sid before 2.2.22-13 for the Apache HTTP Server on Debian GNU/Linux does not properly create the /var/lock/apache2 lock directory, which allows local users to gain privileges via an unspecified symlink attack.


definition_id: oval:org.debian:def:160338101239015818367431505044159095990
title: CVE-2013-1049 cfingerd
description:
Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.


definition_id: oval:org.debian:def:301622005252352236656527285801425454252
title: CVE-2013-1051 apt
description:
apt 0.8.16, 0.9.7, and possibly other versions does not properly handle InRelease files, which allows man-in-the-middle attackers to modify packages before installation via unknown vectors, possibly related to integrity checking and the use of third-party repositories.


definition_id: oval:org.debian:def:122180789681167495198287243766691967339
title: CVE-2013-1059 linux
description:
net/ceph/auth_none.c in the Linux kernel through 3.10 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an auth_reply message that triggers an attempted build_request operation.


definition_id: oval:org.debian:def:177432402146273512494002756566557713060
title: CVE-2013-1061 software-properties
description:
dbus/SoftwarePropertiesDBus.py in Software Properties 0.92.17 before 0.92.17.3, 0.92.9 before 0.92.9.3, and 0.82.7 before 0.82.7.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:327250693233881373978078376959680283852
title: CVE-2013-1064 apt-xapian-index
description:
apt-xapian-index before 0.45ubuntu2.1, 0.44ubuntu7.1, and 0.44ubuntu5.1 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:254914244494087934809060087550518977035
title: CVE-2013-1068 cinder
description:
The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.


definition_id: oval:org.debian:def:255867785846555399837025131211314542615
title: CVE-2013-1362 nagios-nrpe
description:
Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.


definition_id: oval:org.debian:def:97208284831276832033219254621236908900
title: CVE-2013-1364 zabbix
description:
The user.login function in Zabbix before 1.8.16 and 2.x before 2.0.5rc1 allows remote attackers to override LDAP configuration via the cnf parameter.


definition_id: oval:org.debian:def:309971833112139321265030103190793095655
title: CVE-2013-1415 krb5
description:
The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.


definition_id: oval:org.debian:def:267566754041996233620061123706078685373
title: CVE-2013-1416 krb5
description:
The prep_reprocess_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.5 does not properly perform service-principal realm referral, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS-REQ request.


definition_id: oval:org.debian:def:147007553380599151141280474188782659925
title: CVE-2013-1417 krb5
description:
do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.11 before 1.11.4, when a single-component realm name is used, allows remote authenticated users to cause a denial of service (daemon crash) via a TGS-REQ request that triggers an attempted cross-realm referral for a host-based service principal.


definition_id: oval:org.debian:def:250705926960827501903510772628192242441
title: CVE-2013-1418 krb5
description:
The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.


definition_id: oval:org.debian:def:148433966699126759150497260462246394351
title: CVE-2013-1427 lighttpd
description:
The configuration file for the FastCGI PHP support for lighttpd before 1.4.28 on Debian GNU/Linux creates a socket file with a predictable name in /tmp, which allows local users to hijack the PHP control socket and perform unauthorized actions such as forcing the use of a different version of PHP via a symlink attack or a race condition.


definition_id: oval:org.debian:def:101263103266331559243528295953709749061
title: CVE-2013-1428 tinc
description:
Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.


definition_id: oval:org.debian:def:286852963348963588973695314107471726996
title: CVE-2013-1429 lintian
description:
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks.


definition_id: oval:org.debian:def:185442907060858177823673344983654257994
title: CVE-2013-1430 xrdp
description:
An issue was discovered in xrdp before 0.9.1. When successfully logging in using RDP into an xrdp session, the file ~/.vnc/sesman_${username}_passwd is created. Its content is the equivalent of the user's cleartext password, DES encrypted with a known key.


definition_id: oval:org.debian:def:81275067246982365388838182881633535215
title: CVE-2013-1431 telepathy-gabble
description:
The Wocky module in Telepathy Gabble before 0.16.6 and 0.17.x before 0.17.4, when connecting to a "legacy Jabber server," does not properly enforce the WockyConnector:tls-required flag, which allows remote attackers to bypass TLS verification and perform a man-in-the-middle attacks.


definition_id: oval:org.debian:def:67404276426412686943039910507823347495
title: CVE-2013-1432 xen
description:
Xen 4.1.x and 4.2.x, when the XSA-45 patch is in place, does not properly maintain references on pages stored for deferred cleanup, which allows local PV guest kernels to cause a denial of service (premature page free and hypervisor crash) or possibly gain privileges via unspecified vectors.


definition_id: oval:org.debian:def:302857822751485319192543197756481342166
title: CVE-2013-1434 cacti
description:
Multiple SQL injection vulnerabilities in (1) api_poller.php and (2) utility.php in Cacti before 0.8.8b allow remote attackers to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:16672286022042160523953564633354012883
title: CVE-2013-1435 cacti
description:
(1) snmp.php and (2) rrd.php in Cacti before 0.8.8b allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.


definition_id: oval:org.debian:def:134261721617260818353964035932608828410
title: CVE-2013-1436 xmonad-contrib
description:
The XMonad.Hooks.DynamicLog module in xmonad-contrib before 0.11.2 allows remote attackers to execute arbitrary commands via a web page title, which activates the commands when the user clicks on the xmobar window title, as demonstrated using an action tag.


definition_id: oval:org.debian:def:152134227340352134008163252529695293921
title: CVE-2013-1437 libmodule-metadata-perl
description:
Eval injection vulnerability in the Module-Metadata module before 1.000015 for Perl allows remote attackers to execute arbitrary Perl code via the $Version value.


definition_id: oval:org.debian:def:157450736809995791299042038469047725326
title: CVE-2013-1438 darktable
description:
Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw, ufraw, shotwell, and other products, allows context-dependent attackers to cause a denial of service via a crafted photo file that triggers a (1) divide-by-zero, (2) infinite loop, or (3) NULL pointer dereference.


definition_id: oval:org.debian:def:315362544065083657975678781342805656991
title: CVE-2013-1439 darktable
description:
The "faster LJPEG decoder" in libraw 0.13.x, 0.14.x, and 0.15.x before 0.15.4 allows context-dependent attackers to cause a denial of service (NULL pointer dereference) via a crafted photo file.


definition_id: oval:org.debian:def:228826953776590374111859710363338255382
title: CVE-2013-1441 exactimage
description:
econvert in ExactImage 0.8.9 and earlier does not properly initialize the setjmp variable, which allows context-dependent users to cause a denial of service (crash) via a crafted image file.


definition_id: oval:org.debian:def:242073996355130899089813359589798593513
title: CVE-2013-1442 xen
description:
Xen 4.0 through 4.3.x, when using AVX or LWP capable CPUs, does not properly clear previous data from registers when using an XSAVE or XRSTOR to extend the state components of a saved or restored vCPU after touching other restored extended registers, which allows local guest OSes to obtain sensitive information by reading the registers.


definition_id: oval:org.debian:def:274635054676734259316347173871191910494
title: CVE-2013-1443 python-django
description:
The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.


definition_id: oval:org.debian:def:62376681630908186189481698690288914334
title: CVE-2013-1444 txt2man
description:
A certain Debian patch for txt2man 1.5.5, as used in txt2man 1.5.5-2, 1.5.5-4, and others, allows local users to overwrite arbitrary files via a symlink attack on /tmp/2222.


definition_id: oval:org.debian:def:243621560516270962717930881775180878192
title: CVE-2013-1445 python-crypto
description:
The Crypto.Random.atfork function in PyCrypto before 2.6.1 does not properly reseed the pseudo-random number generator (PRNG) before allowing a child process to access it, which makes it easier for context-dependent attackers to obtain sensitive information by leveraging a race condition in which a child process is created and accesses the PRNG within the same rate-limit period as another process.


definition_id: oval:org.debian:def:47018894884901688676084534747583233198
title: CVE-2013-1569 icu
description:
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "checking of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.


definition_id: oval:org.debian:def:51352018837347738034402919781481720063
title: CVE-2013-1572 wireshark
description:
The dissect_oampdu_event_notification function in epan/dissectors/packet-slowprotocols.c in the IEEE 802.3 Slow Protocols dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle certain short lengths, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:323792146602701664311515831560865856560
title: CVE-2013-1573 wireshark
description:
The csnStreamDissector function in epan/dissectors/packet-csn1.c in the CSN.1 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a large number of padding bits, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:75857235322023686027222091876879624135
title: CVE-2013-1574 wireshark
description:
The dissect_bthci_eir_ad_data function in epan/dissectors/packet-bthci_cmd.c in the Bluetooth HCI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a counter variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:261760202944609660812381916143008208776
title: CVE-2013-1575 wireshark
description:
The dissect_r3_cmd_alarmconfigure function in epan/dissectors/packet-assa_r3.c in the R3 dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle a certain alarm length, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:109157202467431658489326463298071162037
title: CVE-2013-1576 wireshark
description:
The dissect_sdp_media_attribute function in epan/dissectors/packet-sdp.c in the SDP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly process crypto-suite parameters, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:151688863777561174853063543769713951880
title: CVE-2013-1577 wireshark
description:
The dissect_sip_p_charging_func_addresses function in epan/dissectors/packet-sip.c in the SIP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle offset data associated with a quoted string, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:80449624412951201759113953356497806242
title: CVE-2013-1578 wireshark
description:
The dissect_pw_eth_heuristic function in epan/dissectors/packet-pw-eth.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle apparent Ethernet address values at the beginning of MPLS data, which allows remote attackers to cause a denial of service (loop) via a malformed packet.


definition_id: oval:org.debian:def:229550051277035278366568410417194993009
title: CVE-2013-1579 wireshark
description:
The rtps_util_add_bitmap function in epan/dissectors/packet-rtps.c in the RTPS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly implement certain nested loops for processing bitmap data, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:238396469000166234405294406261927079829
title: CVE-2013-1580 wireshark
description:
The dissect_cmstatus_tlv function in plugins/docsis/packet-cmstatus.c in the DOCSIS CM-STATUS dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 uses an incorrect data type for a position variable, which allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:29917721880351584371634229680747494583
title: CVE-2013-1581 wireshark
description:
The dissect_pft_fec_detailed function in epan/dissectors/packet-dcp-etsi.c in the DCP-ETSI dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly handle fragment gaps, which allows remote attackers to cause a denial of service (loop) via a malformed packet.


definition_id: oval:org.debian:def:128637296263040914505065015104622795110
title: CVE-2013-1582 wireshark
description:
The dissect_clnp function in epan/dissectors/packet-clnp.c in the CLNP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly manage an offset variable, which allows remote attackers to cause a denial of service (infinite loop or application crash) via a malformed packet.


definition_id: oval:org.debian:def:154380437556184670222931422592258045901
title: CVE-2013-1583 wireshark
description:
The dissect_version_4_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:98174832842361800991006339659643514374
title: CVE-2013-1584 wireshark
description:
The dissect_version_5_and_6_primary_header function in epan/dissectors/packet-dtn.c in the DTN dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 accesses an inappropriate pointer, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:310540044268535512166249547210523659138
title: CVE-2013-1585 wireshark
description:
epan/tvbuff.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly validate certain length values for the MS-MMC dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:165657134072287029458381451059225585035
title: CVE-2013-1586 wireshark
description:
The fragment_set_tot_len function in epan/reassemble.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 does not properly determine the length of a reassembled packet for the DTLS dissector, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:284537141988146102594318973914197202274
title: CVE-2013-1587 wireshark
description:
The dissect_rohc_ir_packet function in epan/dissectors/packet-rohc.c in the ROHC dissector in Wireshark 1.8.x before 1.8.5 does not properly handle unknown profiles, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:237809991941423892688395754519096335513
title: CVE-2013-1588 wireshark
description:
Multiple buffer overflows in the dissect_pft_fec_detailed function in the DCP-ETSI dissector in epan/dissectors/packet-dcp-etsi.c in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allow remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:329367624184389874825475996187059881778
title: CVE-2013-1589 wireshark
description:
Double free vulnerability in epan/proto.c in the dissection engine in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:92892338071012154276136854284623356675
title: CVE-2013-1590 wireshark
description:
Buffer overflow in the NTLMSSP dissector in Wireshark 1.6.x before 1.6.13 and 1.8.x before 1.8.5 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:277243077931267527285416783160856988148
title: CVE-2013-1591 pixman
description:
Stack-based buffer overflow in libpixman, as used in Pale Moon before 15.4 and possibly other products, has unspecified impact and context-dependent attack vectors.  NOTE: this issue might be resultant from an integer overflow in the fast_composite_scaled_bilinear function in pixman-inlines.h, which triggers an infinite loop.


definition_id: oval:org.debian:def:255949657292961749274908530069247306172
title: CVE-2013-1619 gnutls28
description:
The TLS implementation in GnuTLS before 2.12.23, 3.0.x before 3.0.28, and 3.1.x before 3.1.7 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.


definition_id: oval:org.debian:def:32310551271575271832607939358141143120
title: CVE-2013-1620 nss
description:
The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.


definition_id: oval:org.debian:def:127613480190852909767016479425701410265
title: CVE-2013-1624 bouncycastle
description:
The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.


definition_id: oval:org.debian:def:57900836252677872514718342212107775625
title: CVE-2013-1629 python-pip
description:
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a "pip install" operation.


definition_id: oval:org.debian:def:200182692577903250624385726300597172545
title: CVE-2013-1640 puppet
description:
The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.


definition_id: oval:org.debian:def:109257009415528206446310297116245296965
title: CVE-2013-1652 puppet
description:
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users with a valid certificate and private key to read arbitrary catalogs or poison the master's cache via unspecified vectors.


definition_id: oval:org.debian:def:191741137838067213269952151831215553058
title: CVE-2013-1653 puppet
description:
Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, when listening for incoming connections is enabled and allowing access to the "run" REST endpoint is allowed, allows remote authenticated users to execute arbitrary code via a crafted HTTP request.


definition_id: oval:org.debian:def:7755153560695759029056276192955390898
title: CVE-2013-1654 puppet
description:
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, and Puppet Enterprise 2.7.x before 2.7.2, does not properly negotiate the SSL protocol between client and master, which allows remote attackers to conduct SSLv2 downgrade attacks against SSLv3 sessions via unspecified vectors.


definition_id: oval:org.debian:def:120152509636291277026287850527358598785
title: CVE-2013-1655 puppet
description:
Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."


definition_id: oval:org.debian:def:313650310824647514392380229374546288591
title: CVE-2013-1664 cinder
description:
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:239192932336568453982846422986579067589
title: CVE-2013-1665 keystone
description:
The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.


definition_id: oval:org.debian:def:90549704872684776061160644590112846695
title: CVE-2013-1667 perl
description:
The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.


definition_id: oval:org.debian:def:106906565903943279259042848663410741332
title: CVE-2013-1739 nss
description:
Mozilla Network Security Services (NSS) before 3.15.2 does not ensure that data structures are initialized before read operations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a decryption failure.


definition_id: oval:org.debian:def:210635370011938132781027808539341709287
title: CVE-2013-1740 nss
description:
The ssl_Do1stHandshake function in sslsecur.c in libssl in Mozilla Network Security Services (NSS) before 3.15.4, when the TLS False Start feature is enabled, allows man-in-the-middle attackers to spoof SSL servers by using an arbitrary X.509 certificate during certain handshake traffic.


definition_id: oval:org.debian:def:14320681401721719057625488130039410862
title: CVE-2013-1741 nss
description:
Integer overflow in Mozilla Network Security Services (NSS) 3.15 before 3.15.3 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large size value.


definition_id: oval:org.debian:def:108979579109099317969540305102266988620
title: CVE-2013-1753 python2.7
description:
The gzip_decode function in the xmlrpc client library in Python 3.4 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP request.


definition_id: oval:org.debian:def:139700697426076741147562539740318400880
title: CVE-2013-1762 stunnel4
description:
stunnel 4.21 through 4.54, when CONNECT protocol negotiation and NTLM authentication are enabled, does not correctly perform integer conversion, which allows remote proxy servers to execute arbitrary code via a crafted request that triggers a buffer overflow.


definition_id: oval:org.debian:def:114440662082670133692122532769479123708
title: CVE-2013-1766 libvirt
description:
libvirt 1.0.2 and earlier sets the group owner to kvm for device files, which allows local users to write to these files via unspecified vectors.


definition_id: oval:org.debian:def:257724413771144988237677437941806427020
title: CVE-2013-1768 openjpa
description:
The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.


definition_id: oval:org.debian:def:177267032016637300506798762024161494904
title: CVE-2013-1769 telepathy-gabble
description:
A certain hashing algorithm in Telepathy Gabble 0.16.x before 0.16.5 and 0.17.x before 0.17.3 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted message.


definition_id: oval:org.debian:def:98765889925815220616529387623226413249
title: CVE-2013-1770 ganglia
description:
Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.


definition_id: oval:org.debian:def:242612136898745908500664064600452969136
title: CVE-2013-1772 linux
description:
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.


definition_id: oval:org.debian:def:117060300453559828909031396510532550503
title: CVE-2013-1773 linux
description:
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.


definition_id: oval:org.debian:def:7681764363639881069131048279049887346
title: CVE-2013-1775 sudo
description:
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.


definition_id: oval:org.debian:def:340023467067065462510240426188068583357
title: CVE-2013-1776 sudo
description:
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


definition_id: oval:org.debian:def:152028688126056856397609147131997434253
title: CVE-2013-1788 poppler
description:
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.


definition_id: oval:org.debian:def:33688670398032621746127198918619410917
title: CVE-2013-1790 poppler
description:
poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.


definition_id: oval:org.debian:def:143434906741171530777963139552689188862
title: CVE-2013-1792 linux
description:
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.


definition_id: oval:org.debian:def:157013567393443264918748192570587104991
title: CVE-2013-1794 openafs
description:
Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.


definition_id: oval:org.debian:def:26298409870424063999022040184260592445
title: CVE-2013-1795 openafs
description:
Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:274245954132504421324870213389207499449
title: CVE-2013-1796 linux
description:
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.


definition_id: oval:org.debian:def:143047368501002377070544322560141017057
title: CVE-2013-1798 linux
description:
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.


definition_id: oval:org.debian:def:206223368344794599362289466884614856452
title: CVE-2013-1800 ruby-crack
description:
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.


definition_id: oval:org.debian:def:126595929058997454892543816153851514580
title: CVE-2013-1802 ruby-extlib
description:
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.


definition_id: oval:org.debian:def:167323472477619752268720410685533289499
title: CVE-2013-1809 gambas3
description:
Gambas before 3.4.0 allows remote attackers to move or manipulate directory contents or perform symlink attacks due to the creation of insecure temporary directories.


definition_id: oval:org.debian:def:62842381573745078875720983044121263420
title: CVE-2013-1812 ruby-openid
description:
The ruby-openid gem before 2.2.2 for Ruby allows remote OpenID providers to cause a denial of service (CPU consumption) via (1) a large XRDS document or (2) an XML Entity Expansion (XEE) attack.


definition_id: oval:org.debian:def:120295308152317567766246236283405413319
title: CVE-2013-1813 busybox
description:
util-linux/mdev.c in BusyBox before 1.21.0 uses 0777 permissions for parent directories when creating nested directories under /dev/, which allows local users to have unknown impact and attack vectors.


definition_id: oval:org.debian:def:178951028525200169360816041898733202268
title: CVE-2013-1816 mediawiki
description:
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request.


definition_id: oval:org.debian:def:210587035568610224315753879176671368612
title: CVE-2013-1817 mediawiki
description:
MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information.


definition_id: oval:org.debian:def:339188691597542553835781906189383451820
title: CVE-2013-1826 linux
description:
The xfrm_state_netlink function in net/xfrm/xfrm_user.c in the Linux kernel before 3.5.7 does not properly handle error conditions in dump_one_state function calls, which allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:203235891847294809980795689290929876002
title: CVE-2013-1827 linux
description:
net/dccp/ccid.h in the Linux kernel before 3.5.4 allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by leveraging the CAP_NET_ADMIN capability for a certain (1) sender or (2) receiver getsockopt call.


definition_id: oval:org.debian:def:68332998450134915005970319390036409741
title: CVE-2013-1838 nova
description:
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.


definition_id: oval:org.debian:def:117088513090991247396046460543141270766
title: CVE-2013-1840 glance
description:
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image.


definition_id: oval:org.debian:def:200173696950877036922535510119719853198
title: CVE-2013-1845 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.


definition_id: oval:org.debian:def:163579060467869296103733265675052890613
title: CVE-2013-1846 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a LOCK on an activity URL.


definition_id: oval:org.debian:def:151778876237334877707609759594246416953
title: CVE-2013-1847 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.


definition_id: oval:org.debian:def:203656064020865457370614517863004194346
title: CVE-2013-1848 linux
description:
fs/ext3/super.c in the Linux kernel before 3.8.4 uses incorrect arguments to functions in certain circumstances related to printk input, which allows local users to conduct format-string attacks and possibly gain privileges via a crafted application.


definition_id: oval:org.debian:def:63990491542826058297006251218101254470
title: CVE-2013-1849 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a PROPFIND request for an activity URL.


definition_id: oval:org.debian:def:190422476245010282234663691261417166053
title: CVE-2013-1853 almanah
description:
Almanah Diary 0.9.0 and 0.10.0 does not encrypt the database when closed, which allows local users to obtain sensitive information by reading the database.


definition_id: oval:org.debian:def:155592684129034337616209462516488467274
title: CVE-2013-1854 rails
description:
A flaw was found in the way Ruby on Rails handled hashes in certain queries. A remote attacker could use this flaw to perform a denial of service (resource consumption) attack by sending specially crafted queries that would result in the creation of Ruby symbols, which were never garbage collected.


definition_id: oval:org.debian:def:202395941129372107850884518128938385709
title: CVE-2013-1855 rails
description:
A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack.


definition_id: oval:org.debian:def:239517824048460549025201494084067382939
title: CVE-2013-1857 rails
description:
The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a &#x3a; sequence.


definition_id: oval:org.debian:def:241223116520271157129914199650996550851
title: CVE-2013-1860 linux
description:
Heap-based buffer overflow in the wdm_in_callback function in drivers/usb/class/cdc-wdm.c in the Linux kernel before 3.8.4 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted cdc-wdm USB device.


definition_id: oval:org.debian:def:286187957045749308526953543720211857094
title: CVE-2013-1862 apache2
description:
mod_rewrite.c in the mod_rewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator.


definition_id: oval:org.debian:def:241399916554606164975460449185543181989
title: CVE-2013-1868 vlc
description:
Multiple buffer overflows in VideoLAN VLC media player 2.0.4 and earlier allow remote attackers to cause a denial of service (crash) and execute arbitrary code via vectors related to the (1) freetype renderer and (2) HTML subtitle parser.


definition_id: oval:org.debian:def:95680955171782848013016754292260144112
title: CVE-2013-1874 chicken
description:
Untrusted search path vulnerability in csi in Chicken before 4.8.2 allows local users to execute arbitrary code via a Trojan horse .csirc in the current working directory.


definition_id: oval:org.debian:def:152644138783057162106091666134796523108
title: CVE-2013-1881 librsvg
description:
GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:29471657271965169819681713500327643879
title: CVE-2013-1884 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.


definition_id: oval:org.debian:def:41954125235669740279753197028280936298
title: CVE-2013-1895 python-bcrypt
description:
The py-bcrypt module before 0.3 for Python does not properly handle concurrent memory access, which allows attackers to bypass authentication via multiple authentication requests, which trigger the password hash to be overwritten.


definition_id: oval:org.debian:def:102333721413988420873419722889367307414
title: CVE-2013-1896 apache2
description:
mod_dav.c in the Apache HTTP Server before 2.2.25 does not properly determine whether DAV is enabled for a URI, which allows remote attackers to cause a denial of service (segmentation fault) via a MERGE request in which the URI is configured for handling by the mod_dav_svn module, but a certain href attribute in XML data refers to a non-DAV URI.


definition_id: oval:org.debian:def:131096835656871426344101509268589883653
title: CVE-2013-1897 389-ds-base
description:
The do_search function in ldap/servers/slapd/search.c in 389 Directory Server 1.2.x before 1.2.11.20 and 1.3.x before 1.3.0.5 does not properly restrict access to entries when the nsslapd-allow-anonymous-access configuration is set to rootdse and the BASE search scope is used, which allows remote attackers to obtain sensitive information outside of the rootDSE via a crafted LDAP search.


definition_id: oval:org.debian:def:21955745998481959243918444998504446510
title: CVE-2013-1904 roundcube
description:
Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a full pathname in the _value parameter for the generic_message_footer setting in a save-perf action to index.php, as exploited in the wild in March 2013.


definition_id: oval:org.debian:def:72218469965464533513141197948714238310
title: CVE-2013-1909 qpid-python
description:
The Python client in Apache Qpid before 2.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:69977017873951779210273319148677549465
title: CVE-2013-1912 haproxy
description:
Buffer overflow in HAProxy 1.4 through 1.4.22 and 1.5-dev through 1.5-dev17, when HTTP keep-alive is enabled, using HTTP keywords in TCP inspection rules, and running with rewrite rules that appends to requests, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via crafted pipelined HTTP requests that prevent request realignment from occurring.


definition_id: oval:org.debian:def:126910423717307419718700494057392128934
title: CVE-2013-1914 glibc
description:
Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.17 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of domain conversion results.


definition_id: oval:org.debian:def:2330032562274621748351751711779039528
title: CVE-2013-1915 modsecurity-apache
description:
ModSecurity before 2.7.3 allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) vulnerability.


definition_id: oval:org.debian:def:184913846179044714157410200676373642390
title: CVE-2013-1917 xen
description:
Xen 3.1 through 4.x, when running 64-bit hosts on Intel CPUs, does not clear the NT flag when using an IRET after a SYSENTER instruction, which allows PV guest users to cause a denial of service (hypervisor crash) by triggering a #GP fault, which is not properly handled by another IRET instruction.


definition_id: oval:org.debian:def:332506339765814318092360774465848057154
title: CVE-2013-1918 xen
description:
Certain page table manipulation operations in Xen 4.1.x, 4.2.x, and earlier are not preemptible, which allows local PV kernels to cause a denial of service via vectors related to "deep page table traversal."


definition_id: oval:org.debian:def:256197969581017886815198190713817513972
title: CVE-2013-1919 xen
description:
Xen 4.2.x and 4.1.x does not properly restrict access to IRQs, which allows local stub domain clients to gain access to IRQs and cause a denial of service via vectors related to "passed-through IRQs or PCI devices."


definition_id: oval:org.debian:def:245046001121173078207948675687399382122
title: CVE-2013-1922 qemu
description:
qemu-nbd in QEMU, as used in Xen 4.2.x, determines the format of a raw disk image based on the header, which allows local guest OS administrators to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted, a different vulnerability than CVE-2008-2004.


definition_id: oval:org.debian:def:27373386654730089042593061481854443345
title: CVE-2013-1923 nfs-utils
description:
rpc-gssd in nfs-utils before 1.2.8 performs reverse DNS resolution for server names during GSSAPI authentication, which might allow remote attackers to read otherwise-restricted files via DNS spoofing attacks.


definition_id: oval:org.debian:def:140068712580684394074591262416739806385
title: CVE-2013-1926 icedtea-web
description:
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 uses the same class loader for applets with the same codebase path but from different domains, which allows remote attackers to obtain sensitive information or possibly alter other applets via a crafted applet.


definition_id: oval:org.debian:def:165715813127778391514931272808444099760
title: CVE-2013-1927 icedtea-web
description:
The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file, aka "GIFAR."


definition_id: oval:org.debian:def:26532076966527452078986145318809591660
title: CVE-2013-1928 linux
description:
The do_video_set_spu_palette function in fs/compat_ioctl.c in the Linux kernel before 3.6.5 on unspecified architectures lacks a certain error check, which might allow local users to obtain sensitive information from kernel stack memory via a crafted VIDEO_SET_SPU_PALETTE ioctl call on a /dev/dvb device.


definition_id: oval:org.debian:def:247827577324256726055379444541877783542
title: CVE-2013-1929 linux
description:
Heap-based buffer overflow in the tg3_read_vpd function in drivers/net/ethernet/broadcom/tg3.c in the Linux kernel before 3.8.6 allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via crafted firmware that specifies a long string in the Vital Product Data (VPD) data structure.


definition_id: oval:org.debian:def:165332293260884510244691414218968807575
title: CVE-2013-1940 xorg-server
description:
X.Org X server before 1.13.4 and 1.4.x before 1.14.1 does not properly restrict access to input events when adding a new hot-plug device, which might allow physically proximate attackers to obtain sensitive information, as demonstrated by reading passwords from a tty.


definition_id: oval:org.debian:def:222886459948153847216236949014454716292
title: CVE-2013-1944 curl
description:
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.


definition_id: oval:org.debian:def:253478094948081325222990015259533037057
title: CVE-2013-1951 mediawiki
description:
A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.


definition_id: oval:org.debian:def:235232307112138520135486894175675201952
title: CVE-2013-1952 xen
description:
Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, does not properly check the source when accessing a bridge device's interrupt remapping table entries for MSI interrupts, which allows local guest domains to cause a denial of service (interrupt injection) via unspecified vectors.


definition_id: oval:org.debian:def:251782966001315611579437356904000153183
title: CVE-2013-1953 gimp
description:
Integer underflow in the input_bmp_reader function in input-bmp.c in AutoTrace 0.31.1 allows context-dependent attackers to have an unspecified impact via a small value in the biSize field in the header of a BMP file, which triggers a buffer overflow.


definition_id: oval:org.debian:def:322945142584211159583421940614340096585
title: CVE-2013-1954 vlc
description:
The ASF Demuxer (modules/demux/asf/asf.c) in VideoLAN VLC media player 2.0.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted ASF movie that triggers an out-of-bounds read.


definition_id: oval:org.debian:def:195125999191878216534266531235922087811
title: CVE-2013-1956 linux
description:
The create_user_ns function in kernel/user_namespace.c in the Linux kernel before 3.8.6 does not check whether a chroot directory exists that differs from the namespace root directory, which allows local users to bypass intended filesystem restrictions via a crafted clone system call.


definition_id: oval:org.debian:def:56194778589626645410917025303812564687
title: CVE-2013-1957 linux
description:
The clone_mnt function in fs/namespace.c in the Linux kernel before 3.8.6 does not properly restrict changes to the MNT_READONLY flag, which allows local users to bypass an intended read-only property of a filesystem by leveraging a separate mount namespace.


definition_id: oval:org.debian:def:180323139957278316271373855556611496486
title: CVE-2013-1958 linux
description:
The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.8.6 does not properly enforce capability requirements for controlling the PID value associated with a UNIX domain socket, which allows local users to bypass intended access restrictions by leveraging the time interval during which a user namespace has been created but a PID namespace has not been created.


definition_id: oval:org.debian:def:196322752809018125264718088134832286801
title: CVE-2013-1959 linux
description:
kernel/user_namespace.c in the Linux kernel before 3.8.9 does not have appropriate capability requirements for the uid_map and gid_map files, which allows local users to gain privileges by opening a file within an unprivileged process and then modifying the file within a privileged process.


definition_id: oval:org.debian:def:116282373960119458878662517374782904071
title: CVE-2013-1961 tiff
description:
CVE-2013-1961 libtiff (tiff2pdf): Stack-based buffer overflow with malformed image-length and resolution


definition_id: oval:org.debian:def:245742969309365182104364338482619278308
title: CVE-2013-1964 xen
description:
Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors.


definition_id: oval:org.debian:def:194959149866198801016793123995122947417
title: CVE-2013-1968 subversion
description:
Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.


definition_id: oval:org.debian:def:91494933534507255924344091217739038610
title: CVE-2013-1979 linux
description:
The scm_set_cred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application.


definition_id: oval:org.debian:def:304479262900007612293622460039243233737
title: CVE-2013-1980 xmp
description:
Buffer overflow in the get_dsmp function in loaders/masi_load.c in libxmp before 4.1.0 allows remote attackers to execute arbitrary code via a crafted MASI file.


definition_id: oval:org.debian:def:58011257169925499346321355548936546504
title: CVE-2013-1981 libx11
description:
Multiple integer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XQueryFont, (2) _XF86BigfontQueryFont, (3) XListFontsWithInfo, (4) XGetMotionEvents, (5) XListHosts, (6) XGetModifierMapping, (7) XGetPointerMapping, (8) XGetKeyboardMapping, (9) XGetWindowProperty, (10) XGetImage, (11) LoadColornameDB, (12) XrmGetFileDatabase, (13) _XimParseStringFile, or (14) TransFileName functions.


definition_id: oval:org.debian:def:249360387468104971390273825281621893371
title: CVE-2013-1982 libxext
description:
Multiple integer overflows in X.org libXext 1.3.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XcupGetReservedColormapEntries, (2) XcupStoreColors, (3) XdbeGetVisualInfo, (4) XeviGetVisualInfo, (5) XShapeGetRectangles, and (6) XSyncListSystemCounters functions.


definition_id: oval:org.debian:def:327566033509445142735019767444204951823
title: CVE-2013-1983 libxfixes
description:
Integer overflow in X.org libXfixes 5.0 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XFixesGetCursorImage function.


definition_id: oval:org.debian:def:156662342786514823991850037518448013864
title: CVE-2013-1984 libxi
description:
Multiple integer overflows in X.org libXi 1.7.1 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XGetDeviceControl, (2) XGetFeedbackControl, (3) XGetDeviceDontPropagateList, (4) XGetDeviceMotionEvents, (5) XIGetProperty, (6) XIGetSelectedEvents, (7) XGetDeviceProperties, and (8) XListInputDevices functions.


definition_id: oval:org.debian:def:244785281896817643893357558226379742102
title: CVE-2013-1985 libxinerama
description:
Integer overflow in X.org libXinerama 1.1.2 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the XineramaQueryScreens function.


definition_id: oval:org.debian:def:183191865922598101806663406526419146916
title: CVE-2013-1986 libxrandr
description:
Multiple integer overflows in X.org libXrandr 1.4.0 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRRQueryOutputProperty and (2) XRRQueryProviderProperty functions.


definition_id: oval:org.debian:def:249149728705839703268480271926600486406
title: CVE-2013-1987 libxrender
description:
Multiple integer overflows in X.org libXrender 0.9.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XRenderQueryFilters, (2) XRenderQueryFormats, and (3) XRenderQueryPictIndexValues functions.


definition_id: oval:org.debian:def:296726329973956131989449194780419655313
title: CVE-2013-1988 libxres
description:
Multiple integer overflows in X.org libXRes 1.0.6 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XResQueryClients and (2) XResQueryClientResources functions.


definition_id: oval:org.debian:def:252681599895836018479777427431418323963
title: CVE-2013-1989 libxv
description:
Multiple integer overflows in X.org libXv 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvQueryPortAttributes, (2) XvListImageFormats, and (3) XvCreateImage function.


definition_id: oval:org.debian:def:64837423365868353288833864420629841357
title: CVE-2013-1990 libxvmc
description:
Multiple integer overflows in X.org libXvMC 1.0.7 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XvMCListSurfaceTypes and (2) XvMCListSubpictureTypes functions.


definition_id: oval:org.debian:def:326089250319876808393176481938720912388
title: CVE-2013-1991 libxxf86dga
description:
Multiple integer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) XDGAQueryModes and (2) XDGASetMode functions.


definition_id: oval:org.debian:def:271054477488152645733730784078915986403
title: CVE-2013-1992 libdmx
description:
Multiple integer overflows in X.org libdmx 1.1.2 and earlier allow X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the (1) DMXGetScreenAttributes, (2) DMXGetWindowAttributes, and (3) DMXGetInputAttributes functions.


definition_id: oval:org.debian:def:283306914610059437553331996775581787555
title: CVE-2013-1995 libxi
description:
X.org libXi 1.7.1 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the XListInputDevices function.


definition_id: oval:org.debian:def:278737869844577713175723553123654722500
title: CVE-2013-1996 libfs
description:
X.org libFS 1.0.4 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to an unexpected sign extension in the FSOpenServer function.


definition_id: oval:org.debian:def:139965515220362591048127902185286392654
title: CVE-2013-1997 libx11
description:
Multiple buffer overflows in X.org libX11 1.5.99.901 (1.6 RC1) and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XAllocColorCells, (2) _XkbReadGetDeviceInfoReply, (3) _XkbReadGeomShapes, (4) _XkbReadGetGeometryReply, (5) _XkbReadKeySyms, (6) _XkbReadKeyActions, (7) _XkbReadKeyBehaviors, (8) _XkbReadModifierMap, (9) _XkbReadExplicitComponents, (10) _XkbReadVirtualModMap, (11) _XkbReadGetNamesReply, (12) _XkbReadGetMapReply, (13) _XimXGetReadData, (14) XListFonts, (15) XListExtensions, and (16) XGetFontPath functions.


definition_id: oval:org.debian:def:91217580923452796117464045904353183747
title: CVE-2013-1998 libxi
description:
Multiple buffer overflows in X.org libXi 1.7.1 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XGetDeviceButtonMapping, (2) XIPassiveGrabDevice, and (3) XQueryDeviceState functions.


definition_id: oval:org.debian:def:92112582882488484369532438465440625157
title: CVE-2013-1999 libxvmc
description:
Buffer overflow in X.org libXvMC 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvMCGetDRInfo function.


definition_id: oval:org.debian:def:12354601006124371650214387852546796840
title: CVE-2013-2000 libxxf86dga
description:
Multiple buffer overflows in X.org libXxf86dga 1.1.3 and earlier allow X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the (1) XDGAQueryModes and (2) XDGASetMode functions.


definition_id: oval:org.debian:def:15441881405024154004350519163054580239
title: CVE-2013-2001 libxxf86vm
description:
Buffer overflow in X.org libXxf86vm 1.1.2 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XF86VidModeGetGammaRamp function.


definition_id: oval:org.debian:def:5324166388036500235592052272568813178
title: CVE-2013-2002 libxt
description:
Buffer overflow in X.org libXt 1.1.3 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the _XtResourceConfigurationEH function.


definition_id: oval:org.debian:def:50652380359903175738603307566311482759
title: CVE-2013-2003 libxcursor
description:
Integer overflow in X.org libXcursor 1.1.13 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the _XcursorFileHeaderCreate function.


definition_id: oval:org.debian:def:53799230809901889123852568543285503523
title: CVE-2013-2004 libx11
description:
The (1) GetDatabase and (2) _XimParseStringFile functions in X.org libX11 1.5.99.901 (1.6 RC1) and earlier do not restrict the recursion depth when processing directives to include files, which allows X servers to cause a denial of service (stack consumption) via a crafted file.


definition_id: oval:org.debian:def:76659266473323650675849408492595882225
title: CVE-2013-2005 libxt
description:
X.org libXt 1.1.3 and earlier does not check the return value of the XGetWindowProperty function, which allows X servers to trigger use of an uninitialized pointer and memory corruption via vectors related to the (1) ReqCleanup, (2) HandleSelectionEvents, (3) ReqTimedOut, (4) HandleNormal, and (5) HandleSelectionReplies functions.


definition_id: oval:org.debian:def:87369656160375030489254434374251799340
title: CVE-2013-2006 keystone
description:
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.


definition_id: oval:org.debian:def:274937033424725454358973870887020199676
title: CVE-2013-2013 python-keystoneclient
description:
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.


definition_id: oval:org.debian:def:87974629686600715452046000036150745712
title: CVE-2013-2014 keystone
description:
OpenStack Identity (Keystone) before 2013.1 allows remote attackers to cause a denial of service (memory consumption and crash) via multiple long requests.


definition_id: oval:org.debian:def:293610591640663720082317487852333792814
title: CVE-2013-2015 linux
description:
The ext4_orphan_del function in fs/ext4/namei.c in the Linux kernel before 3.7.3 does not properly handle orphan-list entries for non-journal filesystems, which allows physically proximate attackers to cause a denial of service (system hang) via a crafted filesystem on removable media, as demonstrated by the e2fsprogs tests/f_orphan_extents_inode/image.gz test.


definition_id: oval:org.debian:def:147378264091746319893643798032817435611
title: CVE-2013-2016 qemu
description:
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.


definition_id: oval:org.debian:def:117704659641048706956696016626251295481
title: CVE-2013-2017 linux
description:
The veth (aka virtual Ethernet) driver in the Linux kernel before 2.6.34 does not properly manage skbs during congestion, which allows remote attackers to cause a denial of service (system crash) by leveraging lack of skb consumption in conjunction with a double-free error.


definition_id: oval:org.debian:def:36958500320985401688677319491039724718
title: CVE-2013-2018 boinc
description:
Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors.


definition_id: oval:org.debian:def:212523390241474341476927143240674798087
title: CVE-2013-2019 boinc
description:
Stack-based buffer overflow in BOINC 6.10.58 and 6.12.34 allows remote attackers to have unspecified impact via multiple file_signature elements.


definition_id: oval:org.debian:def:311882160296538173422003424633733501538
title: CVE-2013-2020 clamav
description:
Integer underflow in the cli_scanpe function in pe.c in ClamAV before 0.97.8 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an out-of-bounds read.


definition_id: oval:org.debian:def:105218557214558619225142690624470301628
title: CVE-2013-2021 clamav
description:
pdf.c in ClamAV 0.97.1 through 0.97.7 allows remote attackers to cause a denial of service (out-of-bounds-read) via a crafted length value in an encrypted PDF file.


definition_id: oval:org.debian:def:326015526418096657255686314614180612200
title: CVE-2013-2024 chicken
description:
OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.


definition_id: oval:org.debian:def:121483564167352848150161719552338298706
title: CVE-2013-2027 jython
description:
Jython 2.2.1 uses the current umask to set the privileges of the class cache files, which allows local users to bypass intended access restrictions via unspecified vectors.


definition_id: oval:org.debian:def:161699805631951052309723554840825303261
title: CVE-2013-2031 mediawiki
description:
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.


definition_id: oval:org.debian:def:274186863841322272143284553978209290706
title: CVE-2013-2032 mediawiki
description:
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.


definition_id: oval:org.debian:def:11585662335912353318511235651301063488
title: CVE-2013-2035 hawtjni
description:
Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.


definition_id: oval:org.debian:def:3619395947842049850869251598858564630
title: CVE-2013-2037 python-httplib2
description:
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.


definition_id: oval:org.debian:def:276459025391332993413765637016873604304
title: CVE-2013-2038 gpsd
description:
The NMEA0183 driver in gpsd before 3.9 allows remote attackers to cause a denial of service (daemon termination) and possibly execute arbitrary code via a GPS packet with a malformed $GPGGA interpreted sentence that lacks certain fields and a terminator.  NOTE: a separate issue in the AIS driver was also reported, but it might not be a vulnerability.


definition_id: oval:org.debian:def:324802276723629430947175098101071878656
title: CVE-2013-2054 strongswan
description:
Buffer overflow in the atodn function in strongSwan 2.0.0 through 4.3.4, when Opportunistic Encryption is enabled and an RSA key is being used, allows remote attackers to cause a denial of service (pluto IKE daemon crash) and possibly execute arbitrary code via crafted DNS TXT records.  NOTE: this might be the same vulnerability as CVE-2013-2053 and CVE-2013-2054.


definition_id: oval:org.debian:def:189360407837237682310854213752826077596
title: CVE-2013-2058 linux
description:
The host_start function in drivers/usb/chipidea/host.c in the Linux kernel before 3.7.4 does not properly support a certain non-streaming option, which allows local users to cause a denial of service (system crash) by sending a large amount of network traffic through a USB/Ethernet adapter.


definition_id: oval:org.debian:def:193715859787763303904865040251968333916
title: CVE-2013-2059 keystone
description:
OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.


definition_id: oval:org.debian:def:91687971965237110506365248073912181115
title: CVE-2013-2061 openvpn
description:
The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 and earlier, when running in UDP mode, allows remote attackers to obtain sensitive information via a timing attack involving an HMAC comparison function that does not run in constant time and a padding oracle attack on the CBC mode cipher.


definition_id: oval:org.debian:def:286820321436145468627040824968483935806
title: CVE-2013-2064 libxcb
description:
Integer overflow in X.org libxcb 1.9 and earlier allows X servers to trigger allocation of insufficient memory and a buffer overflow via vectors related to the read_packet function.


definition_id: oval:org.debian:def:223015026400286490153038228132054085490
title: CVE-2013-2066 libxv
description:
Buffer overflow in X.org libXv 1.0.7 and earlier allows X servers to cause a denial of service (crash) and possibly execute arbitrary code via crafted length or index values to the XvQueryPortAttributes function.


definition_id: oval:org.debian:def:56483976577219522951045629862960426857
title: CVE-2013-2070 nginx
description:
http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through 1.2.8 and 1.3.0 through 1.4.0, when proxy_pass is used with untrusted HTTP servers, allows remote attackers to cause a denial of service (crash) and obtain sensitive information from worker process memory via a crafted proxy response, a similar vulnerability to CVE-2013-2028.


definition_id: oval:org.debian:def:277109671846198617594681282797034059703
title: CVE-2013-2072 xen
description:
Buffer overflow in the Python bindings for the xc_vcpu_setaffinity call in Xen 4.0.x, 4.1.x, and 4.2.x allows local administrators with permissions to configure VCPU affinity to cause a denial of service (memory corruption and xend toolstack crash) and possibly gain privileges via a crafted cpumap.


definition_id: oval:org.debian:def:4217743288689939285693719482423381627
title: CVE-2013-2073 transifex-client
description:
Transifex command-line client before 0.9 does not validate X.509 certificates, which allows man-in-the-middle attackers to spoof a Transifex server via an arbitrary certificate.


definition_id: oval:org.debian:def:226105312627170179256352891035009719091
title: CVE-2013-2074 kde4libs
description:
kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.


definition_id: oval:org.debian:def:225656761278001956281045353693508341537
title: CVE-2013-2076 xen
description:
Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, only save/restore the FOP, FIP, and FDP x87 registers in FXSAVE/FXRSTOR when an exception is pending, which allows one domain to determine portions of the state of floating point instructions of other domains, which can be leveraged to obtain sensitive information such as cryptographic keys, a similar vulnerability to CVE-2006-1056.  NOTE: this is the documented behavior of AMD64 processors, but it is inconsistent with Intel processors in a security-relevant fashion that was not addressed by the kernels.


definition_id: oval:org.debian:def:160078022552208470268114035161004672753
title: CVE-2013-2077 xen
description:
Xen 4.0.x, 4.1.x, and 4.2.x does not properly restrict the contents of a XRSTOR, which allows local PV guest users to cause a denial of service (unhandled exception and hypervisor crash) via unspecified vectors.


definition_id: oval:org.debian:def:260725918228981981541848587978713503080
title: CVE-2013-2078 xen
description:
Xen 4.0.2 through 4.0.4, 4.1.x, and 4.2.x allows local PV guest users to cause a denial of service (hypervisor crash) via certain bit combinations to the XSETBV instruction.


definition_id: oval:org.debian:def:71546793368665895465512910532776594171
title: CVE-2013-2088 subversion
description:
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.


definition_id: oval:org.debian:def:96174514991672029016916199716369610488
title: CVE-2013-2096 nova
description:
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.


definition_id: oval:org.debian:def:158172854326291163222308051819840997802
title: CVE-2013-2099 bzr
description:
A denial of service flaw was found in the way Python's SSL module implementation performed matching of certain certificate names. A remote attacker able to obtain a valid certificate that contained multiple wildcard characters could use this flaw to issue a request to validate such a certificate, resulting in excessive consumption of CPU.


definition_id: oval:org.debian:def:248076668756064223718711175076972673
title: CVE-2013-2112 subversion
description:
The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.


definition_id: oval:org.debian:def:125813399189893338537069568196220347552
title: CVE-2013-2114 mediawiki
description:
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.


definition_id: oval:org.debian:def:285068272975809145396329560882646978483
title: CVE-2013-2118 spip
description:
SPIP 3.0.x before 3.0.9, 2.1.x before 2.1.22, and 2.0.x before 2.0.23 allows remote attackers to gain privileges and "take editorial control" via vectors related to ecrire/inc/filtres.php.


definition_id: oval:org.debian:def:26607440345443689958959293807990304785
title: CVE-2013-2120 kdeplasma-addons
description:
The %{password(...)} macro in pastemacroexpander.cpp in the KDE Paste Applet before 4.10.5 in kdeplasma-addons does not properly generate passwords, which allows context-dependent attackers to bypass authentication via a brute-force attack.


definition_id: oval:org.debian:def:227437034951796557213412667093706498939
title: CVE-2013-2124 libguestfs
description:
Double free vulnerability in inspect-fs.c in LibguestFS 1.20.x before 1.20.7, 1.21.x, 1.22.0, and 1.23.0 allows remote attackers to cause a denial of service (crash) via empty guest files.


definition_id: oval:org.debian:def:255432097327259195772609492495397855248
title: CVE-2013-2125 opensmtpd
description:
OpenSMTPD before 5.3.2 does not properly handle SSL sessions, which allows remote attackers to cause a denial of service (connection blocking) by keeping a connection open.


definition_id: oval:org.debian:def:313378457802574479462891050590079289875
title: CVE-2013-2126 darktable
description:
Multiple double free vulnerabilities in the LibRaw::unpack function in libraw_cxx.cpp in LibRaw before 0.15.2 allow context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a malformed full-color (1) Foveon or (2) sRAW image file.


definition_id: oval:org.debian:def:9783660673538174940426894039676717847
title: CVE-2013-2128 linux
description:
The tcp_read_sock function in net/ipv4/tcp.c in the Linux kernel before 2.6.34 does not properly manage skb consumption, which allows local users to cause a denial of service (system crash) via a crafted splice system call for a TCP socket.


definition_id: oval:org.debian:def:328495904285584680189593171672840942329
title: CVE-2013-2130 znc
description:
ZNC 1.0 allows remote authenticated users to cause a denial of service (NULL pointer reference and crash) via a crafted request to the (1) editnetwork, (2) editchan, (3) addchan, or (4) delchan page in modules/webadmin.cpp.


definition_id: oval:org.debian:def:78221520266052799178931821849420337698
title: CVE-2013-2131 rrdtool
description:
Format string vulnerability in the rrdtool module 1.4.7 for Python, as used in Zenoss, allows context-dependent attackers to cause a denial of service (crash) via format string specifiers to the rrdtool.graph function.


definition_id: oval:org.debian:def:182122377149191864637414263210478950727
title: CVE-2013-2140 linux
description:
The dispatch_discard_io function in drivers/block/xen-blkback/blkback.c in the Xen blkback implementation in the Linux kernel before 3.10.5 allows guest OS users to cause a denial of service (data loss) via filesystem write operations on a read-only disk that supports the (1) BLKIF_OP_DISCARD (aka discard or TRIM) or (2) SCSI UNMAP feature.


definition_id: oval:org.debian:def:19763914584585976889932585116567394084
title: CVE-2013-2142 libimobiledevice
description:
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.


definition_id: oval:org.debian:def:111732090474507949953489420514380488288
title: CVE-2013-2145 libmodule-signature-perl
description:
The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a "special unknown cipher" that references an untrusted module in Digest/.


definition_id: oval:org.debian:def:44395107118193005257878781435054476621
title: CVE-2013-2146 linux
description:
arch/x86/kernel/cpu/perf_event_intel.c in the Linux kernel before 3.8.9, when the Performance Events Subsystem is enabled, specifies an incorrect bitmask, which allows local users to cause a denial of service (general protection fault and system crash) by attempting to set a reserved bit.


definition_id: oval:org.debian:def:189366067915644964128153439563775868054
title: CVE-2013-2147 linux
description:
The HP Smart Array controller disk-array driver and Compaq SMART2 controller disk-array driver in the Linux kernel through 3.9.4 do not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory via (1) a crafted IDAGETPCIINFO command for a /dev/ida device, related to the ida_locked_ioctl function in drivers/block/cpqarray.c or (2) a crafted CCISS_PASSTHRU32 command for a /dev/cciss device, related to the cciss_ioctl32_passthru function in drivers/block/cciss.c.


definition_id: oval:org.debian:def:337766790521722075881548355880170980594
title: CVE-2013-2153 xml-security-c
description:
The XML digital signature functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to reuse signatures and spoof arbitrary content via crafted Reference elements in the Signature, aka "XML Signature Bypass issue."


definition_id: oval:org.debian:def:308566501961916577721985571357297149806
title: CVE-2013-2154 xml-security-c
description:
Stack-based buffer overflow in the XML Signature Reference functionality (xsec/dsig/DSIGReference.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions, probably related to the DSIGReference::getURIBaseTXFM function.


definition_id: oval:org.debian:def:252520112622819521627311099127177011539
title: CVE-2013-2155 xml-security-c
description:
Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 does not properly validate length values, which allows remote attackers to cause a denial of service or bypass the CVE-2009-0217 protection mechanism and spoof a signature via crafted length values to the (1) compareBase64StringToRaw, (2) DSIGAlgorithmHandlerDefault, or (3) DSIGAlgorithmHandlerDefault::verify functions.


definition_id: oval:org.debian:def:112661890248394513073472857408926499076
title: CVE-2013-2156 xml-security-c
description:
Heap-based buffer overflow in the Exclusive Canonicalization functionality (xsec/canon/XSECC14n20010315.cpp) in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted PrefixList attribute.


definition_id: oval:org.debian:def:302241685033724547393975045804779651690
title: CVE-2013-2157 keystone
description:
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.


definition_id: oval:org.debian:def:335481557186808034778593904358943024609
title: CVE-2013-2161 swift
description:
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.


definition_id: oval:org.debian:def:271335559024050917513367892772683568786
title: CVE-2013-2164 linux
description:
The mmc_ioctl_cdrom_read_data function in drivers/cdrom/cdrom.c in the Linux kernel through 3.10 allows local users to obtain sensitive information from kernel memory via a read operation on a malfunctioning CD-ROM drive.


definition_id: oval:org.debian:def:123337265881633746096785399160209171218
title: CVE-2013-2166 python-keystoneclient
description:
CVE-2013-2166 CVE-2013-2167 python-keystoneclient: middleware memcache encryption and signing bypass


definition_id: oval:org.debian:def:203514330666637202206233714988388059946
title: CVE-2013-2168 dbus
description:
The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1.7.x before 1.7.4 allows local users to cause a denial of service (service crash) via a crafted message.


definition_id: oval:org.debian:def:128770577276313800815390655282749076307
title: CVE-2013-2172 libxml-security-java
description:
jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."


definition_id: oval:org.debian:def:255721117282519538353703360351940975917
title: CVE-2013-2173 wordpress
description:
wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service (CPU consumption) via a crafted value of a certain wp-postpass cookie.


definition_id: oval:org.debian:def:217424441284155099559380659454814267933
title: CVE-2013-2174 curl
description:
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.


definition_id: oval:org.debian:def:49317810846151410796229351316011290699
title: CVE-2013-2175 haproxy
description:
HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence count, allows remote attackers to cause a denial of service (negative array index usage and crash) via an HTTP header with a certain number of values, related to the MAX_HDR_HISTORY variable.


definition_id: oval:org.debian:def:275401531657414543668911083180354800599
title: CVE-2013-2178 fail2ban
description:
The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly validate log messages, which allows remote attackers to block arbitrary IP addresses via certain messages in a request.


definition_id: oval:org.debian:def:173246101386982214838368616263073031459
title: CVE-2013-2186 libcommons-fileupload-java
description:
The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.


definition_id: oval:org.debian:def:305784956719568846130609639168241154479
title: CVE-2013-2189 libreoffice
description:
Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via invalid PLCF data in a DOC document file.


definition_id: oval:org.debian:def:113844239671650854943291627143686906250
title: CVE-2013-2190 clutter-1.0
description:
The translate_hierarchy_event function in x11/clutter-device-manager-xi2.c in Clutter, when resuming the system, does not properly handle XIQueryDevice errors when a device has "disappeared," which causes the gnome-shell to crash and allows physically proximate attackers to access the previous gnome-shell session via unspecified vectors.


definition_id: oval:org.debian:def:15665538057245897649883888010647054743
title: CVE-2013-2194 xen
description:
Multiple integer overflows in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel.


definition_id: oval:org.debian:def:43269035196539703891943621760407431602
title: CVE-2013-2195 xen
description:
The Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "pointer dereferences" involving unexpected calculations.


definition_id: oval:org.debian:def:75569762069184371838169110873701084091
title: CVE-2013-2196 xen
description:
Multiple unspecified vulnerabilities in the Elf parser (libelf) in Xen 4.2.x and earlier allow local guest administrators with certain permissions to have an unspecified impact via a crafted kernel, related to "other problems" that are not CVE-2013-2194 or CVE-2013-2195.


definition_id: oval:org.debian:def:174243349030756506315121741501787130028
title: CVE-2013-2199 wordpress
description:
The HTTP API in WordPress before 3.5.2 allows remote attackers to send HTTP requests to intranet servers via unspecified vectors, related to a Server-Side Request Forgery (SSRF) issue, a similar vulnerability to CVE-2013-0235.


definition_id: oval:org.debian:def:208056199859946762326369431928629431444
title: CVE-2013-2200 wordpress
description:
WordPress before 3.5.2 does not properly check the capabilities of roles, which allows remote authenticated users to bypass intended restrictions on publishing and authorship reassignment via unspecified vectors.


definition_id: oval:org.debian:def:324004751343351128771296173826913548220
title: CVE-2013-2201 wordpress
description:
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) uploads of media files, (2) editing of media files, (3) installation of plugins, (4) updates to plugins, (5) installation of themes, or (6) updates to themes.


definition_id: oval:org.debian:def:171854069211622120319707817604391997889
title: CVE-2013-2202 wordpress
description:
WordPress before 3.5.2 allows remote attackers to read arbitrary files via an oEmbed XML provider response containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:237629735650722722452576658874444078281
title: CVE-2013-2203 wordpress
description:
WordPress before 3.5.2, when the uploads directory forbids write access, allows remote attackers to obtain sensitive information via an invalid upload request, which reveals the absolute path in an XMLHttpRequest error message.


definition_id: oval:org.debian:def:133367264146326890699433968656252737106
title: CVE-2013-2204 wordpress
description:
moxieplayer.as in Moxiecode moxieplayer, as used in the TinyMCE Media plugin in WordPress before 3.5.2 and other products, does not consider the presence of a # (pound sign) character during extraction of the QUERY_STRING, which allows remote attackers to pass arbitrary parameters to a Flash application, and conduct content-spoofing attacks, via a crafted string after a ? (question mark) character.


definition_id: oval:org.debian:def:172947569004584222946849631632290134135
title: CVE-2013-2205 wordpress
description:
The default configuration of SWFUpload in WordPress before 3.5.2 has an unrestrictive security.allowDomain setting, which allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted web site.


definition_id: oval:org.debian:def:222823962936554218152477122178592052320
title: CVE-2013-2207 glibc
description:
pt_chown in GNU C Library (aka glibc or libc6) before 2.18 does not properly check permissions for tty files, which allows local users to change the permission on the files and obtain access to arbitrary pseudo-terminals by leveraging a FUSE file system.


definition_id: oval:org.debian:def:161415204264264686026296191927397535730
title: CVE-2013-2208 tpp
description:
tpp 1.3.1 allows remote attackers to execute arbitrary commands via a --exec command in a TPP template file.


definition_id: oval:org.debian:def:73717383004632935317310659905586617082
title: CVE-2013-2210 xml-security-c
description:
Heap-based buffer overflow in the XML Signature Reference functionality in Apache Santuario XML Security for C++ (aka xml-security-c) before 1.7.2 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via malformed XPointer expressions.  NOTE: this is due to an incorrect fix for CVE-2013-2154.


definition_id: oval:org.debian:def:46548699280210242699999493351687574780
title: CVE-2013-2211 xen
description:
The libxenlight (libxl) toolstack library in Xen 4.0.x, 4.1.x, and 4.2.x uses weak permissions for xenstore keys for paravirtualised and emulated serial console devices, which allows local guest administrators to modify the xenstore value via unspecified vectors.


definition_id: oval:org.debian:def:189900506539873104172667918663601610751
title: CVE-2013-2212 xen
description:
The vmx_set_uc_mode function in Xen 3.3 through 4.3, when disabling caches, allows local HVM guests with access to memory mapped I/O regions to cause a denial of service (CPU consumption and possibly hypervisor or guest kernel panic) via a crafted GFN range.


definition_id: oval:org.debian:def:76072091899132718143144488471142068517
title: CVE-2013-2217 suds
description:
cache.py in Suds 0.4, when tempdir is set to None, allows local users to redirect SOAP queries and possibly have other unspecified impact via a symlink attack on a cache file with a predictable name in /tmp/suds/.


definition_id: oval:org.debian:def:185542369358533617080003526055500416000
title: CVE-2013-2218 libvirt
description:
Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.0.6 allows remote attackers to cause a denial of service (libvirtd crash) via a filtering flag that causes an interface to be skipped, as demonstrated by the "virsh iface-list --inactive" command.


definition_id: oval:org.debian:def:151037170260983940336155333616294429064
title: CVE-2013-2219 389-ds-base
description:
The Red Hat Directory Server before 8.2.11-13 and 389 Directory Server do not properly restrict access to entity attributes, which allows remote authenticated users to obtain sensitive information via a search query for the attribute.


definition_id: oval:org.debian:def:18094450394918596358017719156735259609
title: CVE-2013-2220 php-radius
description:
Buffer overflow in the radius_get_vendor_attr function in the Radius extension before 1.2.7 for PHP allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large Vendor Specific Attributes (VSA) length value.


definition_id: oval:org.debian:def:70596949399617451739224540197089088717
title: CVE-2013-2230 libvirt
description:
The qemu driver (qemu/qemu_driver.c) in libvirt before 1.1.1 allows remote authenticated users to cause a denial of service (daemon crash) via unspecified vectors involving "multiple events registration."


definition_id: oval:org.debian:def:169821269355996445743793755787004313666
title: CVE-2013-2232 linux
description:
The ip6_sk_dst_check function in net/ipv6/ip6_output.c in the Linux kernel before 3.10 allows local users to cause a denial of service (system crash) by using an AF_INET6 socket for a connection to an IPv4 interface.


definition_id: oval:org.debian:def:80449456538235128404334907812160103741
title: CVE-2013-2233 ansible
description:
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.


definition_id: oval:org.debian:def:30308725488865101808050390086279117023
title: CVE-2013-2234 linux
description:
The (1) key_notify_sa_flush and (2) key_notify_policy_flush functions in net/key/af_key.c in the Linux kernel before 3.10 do not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify interface of an IPSec key_socket.


definition_id: oval:org.debian:def:190182837459592174772293598570042338849
title: CVE-2013-2236 quagga
description:
Stack-based buffer overflow in the new_msg_lsa_change_notify function in the OSPFD API (ospf_api.c) in Quagga before 0.99.22.2, when --enable-opaque-lsa and the -a command line option are used, allows remote attackers to cause a denial of service (crash) via a large LSA.


definition_id: oval:org.debian:def:37053763293410346433370072918024382107
title: CVE-2013-2237 linux
description:
The key_notify_policy_flush function in net/key/af_key.c in the Linux kernel before 3.9 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory by reading a broadcast message from the notify_policy interface of an IPSec key_socket.


definition_id: oval:org.debian:def:142891989089113918588131777488149379640
title: CVE-2013-2249 apache2
description:
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for a session without considering the dirty flag and the requirement for a new session ID, which has unspecified impact and remote attack vectors.


definition_id: oval:org.debian:def:80111495794200877912308541378661118362
title: CVE-2013-2255 keystone
description:
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.


definition_id: oval:org.debian:def:124596136338787094044485315944442395325
title: CVE-2013-2264 asterisk
description:
The SIP channel driver in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; Asterisk Business Edition (BE) C.3.x before C.3.8.1; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones exhibits different behavior for invalid INVITE, SUBSCRIBE, and REGISTER transactions depending on whether the user account exists, which allows remote attackers to enumerate account names by (1) reading HTTP status codes, (2) reading additional text in a 403 (aka Forbidden) response, or (3) observing whether certain retransmissions occur.


definition_id: oval:org.debian:def:168850865042018234896606577851486592417
title: CVE-2013-2266 bind9
description:
libdns in ISC BIND 9.7.x and 9.8.x before 9.8.4-P2, 9.8.5 before 9.8.5b2, 9.9.x before 9.9.2-P2, and 9.9.3 before 9.9.3b2 on UNIX platforms allows remote attackers to cause a denial of service (memory consumption) via a crafted regular expression, as demonstrated by a memory-exhaustion attack against a machine running a named process.


definition_id: oval:org.debian:def:45026089522287079735306888808609138726
title: CVE-2013-2274 puppet
description:
Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master, or an agent with puppet kick enabled, via a crafted request for a report.


definition_id: oval:org.debian:def:40443574735876169401113006412638091591
title: CVE-2013-2275 puppet
description:
The default configuration for puppet masters 0.25.0 and later in Puppet before 2.6.18, 2.7.x before 2.7.21, and 3.1.x before 3.1.1, and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2, allows remote authenticated nodes to submit reports for other nodes via unspecified vectors.


definition_id: oval:org.debian:def:175343313331135854476849141165042896593
title: CVE-2013-2277 ffmpeg
description:
The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 1.1.3 does not validate the relationship between luma depth and chroma depth, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted H.264 data.


definition_id: oval:org.debian:def:87759346977269441084384349176839776281
title: CVE-2013-2298 boinc
description:
Multiple stack-based buffer overflows in the XML parser in BOINC 7.x allow attackers to have unspecified impact via a crafted XML file, related to the scheduler.


definition_id: oval:org.debian:def:280978429503069010128699480667977951613
title: CVE-2013-2383 icu
description:
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2384, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "handling of [a] glyph table" in the International Components for Unicode (ICU) Layout Engine before 51.2.


definition_id: oval:org.debian:def:131504359564992608439958626223440522524
title: CVE-2013-2384 icu
description:
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D, a different vulnerability than CVE-2013-1569, CVE-2013-2383, and CVE-2013-2420. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font layout" in the International Components for Unicode (ICU) Layout Engine before 51.2.


definition_id: oval:org.debian:def:318924706686215249869198306991428975564
title: CVE-2013-2419 icu
description:
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to "font processing errors" in the International Components for Unicode (ICU) Layout Engine before 51.2.


definition_id: oval:org.debian:def:239536365107496207248529297518671931363
title: CVE-2013-2475 wireshark
description:
The TCP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:162168773802511579655771459227574567904
title: CVE-2013-2476 wireshark
description:
The dissect_hartip function in epan/dissectors/packet-hartip.c in the HART/IP dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a packet with a header that is too short.


definition_id: oval:org.debian:def:192750699313123505073647510419701162355
title: CVE-2013-2477 wireshark
description:
The CSN.1 dissector in Wireshark 1.8.x before 1.8.6 does not properly manage function pointers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:18815422282059368269952619768462129874
title: CVE-2013-2478 wireshark
description:
The dissect_server_info function in epan/dissectors/packet-ms-mms.c in the MS-MMS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not properly manage string lengths, which allows remote attackers to cause a denial of service (application crash) via a malformed packet that (1) triggers an integer overflow or (2) has embedded '\0' characters in a string.


definition_id: oval:org.debian:def:141107303271628596035752233067043243360
title: CVE-2013-2479 wireshark
description:
The dissect_mpls_echo_tlv_dd_map function in epan/dissectors/packet-mpls-echo.c in the MPLS Echo dissector in Wireshark 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via invalid Sub-tlv data.


definition_id: oval:org.debian:def:148939957471985651808205688575515402061
title: CVE-2013-2480 wireshark
description:
The RTPS and RTPS2 dissectors in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allow remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:142565315297992579847048622305133757564
title: CVE-2013-2481 wireshark
description:
Integer signedness error in the dissect_mount_dirpath_call function in epan/dissectors/packet-mount.c in the Mount dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6, when nfs_file_name_snooping is enabled, allows remote attackers to cause a denial of service (application crash) via a negative length value.


definition_id: oval:org.debian:def:310358977422088528663832767360717847976
title: CVE-2013-2482 wireshark
description:
The AMPQ dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:219816224478265192232178118116936182393
title: CVE-2013-2483 wireshark
description:
The acn_add_dmp_data function in epan/dissectors/packet-acn.c in the ACN dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via an invalid count value in ACN_DMP_ADT_D_RE DMP data.


definition_id: oval:org.debian:def:304049875555415340774952053710268682399
title: CVE-2013-2484 wireshark
description:
The CIMD dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:257682044212988607273492006938178092059
title: CVE-2013-2485 wireshark
description:
The FCSP dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.


definition_id: oval:org.debian:def:94294516071683953073583540900273903563
title: CVE-2013-2486 wireshark
description:
The dissect_diagnosticrequest function in epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet.


definition_id: oval:org.debian:def:135746294699475927759091999722861850038
title: CVE-2013-2487 wireshark
description:
epan/dissectors/packet-reload.c in the REsource LOcation And Discovery (aka RELOAD) dissector in Wireshark 1.8.x before 1.8.6 uses incorrect integer data types, which allows remote attackers to cause a denial of service (infinite loop) via crafted integer values in a packet, related to the (1) dissect_icecandidates, (2) dissect_kinddata, (3) dissect_nodeid_list, (4) dissect_storeans, (5) dissect_storereq, (6) dissect_storeddataspecifier, (7) dissect_fetchreq, (8) dissect_findans, (9) dissect_diagnosticinfo, (10) dissect_diagnosticresponse, (11) dissect_reload_messagecontents, and (12) dissect_reload_message functions, a different vulnerability than CVE-2013-2486.


definition_id: oval:org.debian:def:198508512387760860741752197499930332262
title: CVE-2013-2488 wireshark
description:
The DTLS dissector in Wireshark 1.6.x before 1.6.14 and 1.8.x before 1.8.6 does not validate the fragment offset before invoking the reassembly state machine, which allows remote attackers to cause a denial of service (application crash) via a large offset value that triggers write access to an invalid memory location.


definition_id: oval:org.debian:def:256767718419978607553014342230126566171
title: CVE-2013-2494 isc-dhcp
description:
libdns in ISC DHCP 4.2.x before 4.2.5-P1 allows remote name servers to cause a denial of service (memory consumption) via vectors involving a regular expression, as demonstrated by a memory-exhaustion attack against a machine running a dhcpd process, a related issue to CVE-2013-2266.


definition_id: oval:org.debian:def:307219227157556780527846330246859590149
title: CVE-2013-2495 ffmpeg
description:
The iff_read_header function in iff.c in libavformat in FFmpeg through 1.1.3 does not properly handle data sizes for Interchange File Format (IFF) data during operations involving a CMAP chunk or a video codec, which allows remote attackers to cause a denial of service (integer overflow, out-of-bounds array access, and application crash) or possibly have unspecified other impact via a crafted header.


definition_id: oval:org.debian:def:107792536237501127002574262521552722414
title: CVE-2013-2496 ffmpeg
description:
The msrle_decode_8_16_24_32 function in msrledec.c in libavcodec in FFmpeg through 1.1.3 does not properly determine certain end pointers, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted Microsoft RLE data.


definition_id: oval:org.debian:def:38836268522623393547497434177835530790
title: CVE-2013-2503 privoxy
description:
Privoxy before 3.0.21 does not properly handle Proxy-Authenticate and Proxy-Authorization headers in the client-server data stream, which makes it easier for remote HTTP servers to spoof the intended proxy service via a 407 (aka Proxy Authentication Required) HTTP status code.


definition_id: oval:org.debian:def:122148986007547150945343403020907576341
title: CVE-2013-2546 linux
description:
The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:304191429597539656192558437666533761382
title: CVE-2013-2547 linux
description:
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:180754700113444394129802639162087655655
title: CVE-2013-2548 linux
description:
The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.


definition_id: oval:org.debian:def:281031034348274296858957190782712612574
title: CVE-2013-2561 ibutils
description:
OpenFabrics ibutils 1.5.7 allows local users to overwrite arbitrary files via a symlink attack on (1) ibdiagnet.db, (2) ibdiagnet.fdbs, (3) ibdiagnet_ibis.log, (4) ibdiagnet.log, (5) ibdiagnet.lst, (6) ibdiagnet.mcfdbs, (7) ibdiagnet.pkey, (8) ibdiagnet.psl, (9) ibdiagnet.slvl, or (10) ibdiagnet.sm in /tmp/.


definition_id: oval:org.debian:def:86294168079953772483188381672758584859
title: CVE-2013-2596 linux
description:
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to create a read-write memory mapping for the entirety of kernel memory, and consequently gain privileges, via crafted /dev/graphics/fb0 mmap2 system calls, as demonstrated by the Motochopper pwn program.


definition_id: oval:org.debian:def:67853091161911503214052690583619478464
title: CVE-2013-2625 otrs2
description:
An Access Bypass issue exists in OTRS Help Desk before 3.2.4, 3.1.14, and 3.0.19, OTRS ITSM before 3.2.3, 3.1.8, and 3.0.7, and FAQ before 2.2.3, 2.1.4, and 2.0.8. Access rights by the object linking mechanism is not verified


definition_id: oval:org.debian:def:329702357024760205605812215259933207106
title: CVE-2013-2634 linux
description:
net/dcb/dcbnl.c in the Linux kernel before 3.8.4 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:128746938187307403986494087760453589338
title: CVE-2013-2635 linux
description:
The rtnl_fill_ifinfo function in net/core/rtnetlink.c in the Linux kernel before 3.8.4 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.


definition_id: oval:org.debian:def:326671671015433044318939603404630690796
title: CVE-2013-2686 asterisk
description:
main/http.c in the HTTP server in Asterisk Open Source 1.8.x before 1.8.20.2, 10.x before 10.12.2, and 11.x before 11.2.2; Certified Asterisk 1.8.15 before 1.8.15-cert2; and Asterisk Digiumphones 10.x-digiumphones before 10.12.2-digiumphones does not properly restrict Content-Length values, which allows remote attackers to conduct stack-consumption attacks and cause a denial of service (daemon crash) via a crafted HTTP POST request.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-5976.


definition_id: oval:org.debian:def:187366502783072548571203199539455626035
title: CVE-2013-2765 modsecurity-apache
description:
The ModSecurity module before 2.7.4 for the Apache HTTP Server allows remote attackers to cause a denial of service (NULL pointer dereference, process crash, and disk consumption) via a POST request with a large body and a crafted Content-Type header.


definition_id: oval:org.debian:def:76146634032624587204408084255521963026
title: CVE-2013-2776 sudo
description:
sudo 1.3.5 through 1.7.10p5 and 1.8.0 through 1.8.6p6, when running on systems without /proc or the sysctl function with the tty_tickets option enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


definition_id: oval:org.debian:def:263021846557681289550078344169944040529
title: CVE-2013-2777 sudo
description:
sudo before 1.7.10p5 and 1.8.x before 1.8.6p6, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to a session without a controlling terminal device and connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.


definition_id: oval:org.debian:def:33825857434210846225362195083406499121
title: CVE-2013-2850 linux
description:
Heap-based buffer overflow in the iscsi_add_notunderstood_response function in drivers/target/iscsi/iscsi_target_parameters.c in the iSCSI target subsystem in the Linux kernel through 3.9.4 allows remote attackers to cause a denial of service (memory corruption and OOPS) or possibly execute arbitrary code via a long key that is not properly handled during construction of an error-response packet.


definition_id: oval:org.debian:def:45345488170192818237240958700129719535
title: CVE-2013-2851 linux
description:
Format string vulnerability in the register_disk function in block/genhd.c in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and writing format string specifiers to /sys/module/md_mod/parameters/new_array in order to create a crafted /dev/md device name.


definition_id: oval:org.debian:def:14218948066673461766426518000173114418
title: CVE-2013-2852 linux
description:
Format string vulnerability in the b43_request_firmware function in drivers/net/wireless/b43/main.c in the Broadcom B43 wireless driver in the Linux kernel through 3.9.4 allows local users to gain privileges by leveraging root access and including format string specifiers in an fwpostfix modprobe parameter, leading to improper construction of an error message.


definition_id: oval:org.debian:def:22754754139429835262417017204236230651
title: CVE-2013-2877 libxml2
description:
parser.c in libxml2 before 2.9.0, as used in Google Chrome before 28.0.1500.71 and other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a document that ends abruptly, related to the lack of certain checks for the XML_PARSER_EOF state.


definition_id: oval:org.debian:def:67590267610349512173648936989461328308
title: CVE-2013-2888 linux
description:
Multiple array index errors in drivers/hid/hid-core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11 allow physically proximate attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted device that provides an invalid Report ID.


definition_id: oval:org.debian:def:25684848463214588879593828662423916002
title: CVE-2013-2889 linux
description:
drivers/hid/hid-zpff.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_ZEROPLUS is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


definition_id: oval:org.debian:def:38376817906919735165504823216614961385
title: CVE-2013-2891 linux
description:
drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_STEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


definition_id: oval:org.debian:def:273870469993021270378409758000013202477
title: CVE-2013-2892 linux
description:
drivers/hid/hid-pl.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PANTHERLORD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


definition_id: oval:org.debian:def:209919782076414650193829916472548525599
title: CVE-2013-2893 linux
description:
The Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_LOGITECH_FF, CONFIG_LOGIG940_FF, or CONFIG_LOGIWHEELS_FF is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device, related to (1) drivers/hid/hid-lgff.c, (2) drivers/hid/hid-lg3ff.c, and (3) drivers/hid/hid-lg4ff.c.


definition_id: oval:org.debian:def:142834118390142087923472062003618850304
title: CVE-2013-2894 linux
description:
drivers/hid/hid-lenovo-tpkbd.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LENOVO_TPKBD is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.


definition_id: oval:org.debian:def:57316614824803149791481011822099370153
title: CVE-2013-2895 linux
description:
drivers/hid/hid-logitech-dj.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_LOGITECH_DJ is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or obtain sensitive information from kernel memory via a crafted device.


definition_id: oval:org.debian:def:249620623477788902833389593194643589571
title: CVE-2013-2896 linux
description:
drivers/hid/hid-ntrig.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_NTRIG is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.


definition_id: oval:org.debian:def:194899639121180855346582979509916569953
title: CVE-2013-2897 linux
description:
Multiple array index errors in drivers/hid/hid-multitouch.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_MULTITOUCH is enabled, allow physically proximate attackers to cause a denial of service (heap memory corruption, or NULL pointer dereference and OOPS) via a crafted device.


definition_id: oval:org.debian:def:121695419740405126574721051640411227431
title: CVE-2013-2898 linux
description:
drivers/hid/hid-sensor-hub.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_SENSOR_HUB is enabled, allows physically proximate attackers to obtain sensitive information from kernel memory via a crafted device.


definition_id: oval:org.debian:def:244616400228539964618820384161363566668
title: CVE-2013-2899 linux
description:
drivers/hid/hid-picolcd_core.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIG_HID_PICOLCD is enabled, allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) via a crafted device.


definition_id: oval:org.debian:def:303617463001168876745293408565775875165
title: CVE-2013-2924 icu
description:
Use-after-free vulnerability in International Components for Unicode (ICU), as used in Google Chrome before 30.0.1599.66 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.


definition_id: oval:org.debian:def:303054052747667778615273791682324698217
title: CVE-2013-2929 linux
description:
The Linux kernel before 3.12.2 does not properly use the get_dumpable function, which allows local users to bypass intended ptrace restrictions or obtain sensitive information from IA64 scratch registers via a crafted application, related to kernel/ptrace.c and arch/ia64/include/asm/processor.h.


definition_id: oval:org.debian:def:217698876413799957014829573485678342874
title: CVE-2013-2930 linux
description:
The perf_trace_event_perm function in kernel/trace/trace_event_perf.c in the Linux kernel before 3.12.2 does not properly restrict access to the perf subsystem, which allows local users to enable function tracing via a crafted application.


definition_id: oval:org.debian:def:278563800385408503851536829595494006915
title: CVE-2013-2944 strongswan
description:
strongSwan 4.3.5 through 5.0.3, when using the OpenSSL plugin for ECDSA signature verification, allows remote attackers to authenticate as other users via an invalid signature.


definition_id: oval:org.debian:def:252046045510145559797229452026371996402
title: CVE-2013-3076 linux
description:
The crypto API in the Linux kernel through 3.9-rc8 does not initialize certain length variables, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call, related to the hash_recvmsg function in crypto/algif_hash.c and the skcipher_recvmsg function in crypto/algif_skcipher.c.


definition_id: oval:org.debian:def:218868543786129783028916634316803620686
title: CVE-2013-3077 kfreebsd-10
description:
Multiple integer overflows in the IP_MSFILTER and IPV6_MSFILTER features in (1) sys/netinet/in_mcast.c and (2) sys/netinet6/in6_mcast.c in the multicast implementation in the kernel in FreeBSD 8.3 through 9.2-PRERELEASE allow local users to bypass intended restrictions on kernel-memory read and write operations, and consequently gain privileges, via vectors involving a large number of source-filter entries.


definition_id: oval:org.debian:def:58940688730536752989640709211924242429
title: CVE-2013-3221 rails
description:
The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the "typed XML" feature and a MySQL database.


definition_id: oval:org.debian:def:5603004963714188939640642742451974898
title: CVE-2013-3222 linux
description:
The vcc_recvmsg function in net/atm/common.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:111560116842379584191896405251980625339
title: CVE-2013-3223 linux
description:
The ax25_recvmsg function in net/ax25/af_ax25.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:288377320863578102623563659162573056696
title: CVE-2013-3224 linux
description:
The bt_sock_recvmsg function in net/bluetooth/af_bluetooth.c in the Linux kernel before 3.9-rc7 does not properly initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:144520564939370881214456335120958338024
title: CVE-2013-3225 linux
description:
The rfcomm_sock_recvmsg function in net/bluetooth/rfcomm/sock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:223785913570057083363985388091474964569
title: CVE-2013-3227 linux
description:
The caif_seqpkt_recvmsg function in net/caif/caif_socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:92058596732202699053193143595811831710
title: CVE-2013-3228 linux
description:
The irda_recvmsg_dgram function in net/irda/af_irda.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:269561807025058095337033630084088587683
title: CVE-2013-3229 linux
description:
The iucv_sock_recvmsg function in net/iucv/af_iucv.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:135394326988430798573259006753002074060
title: CVE-2013-3231 linux
description:
The llc_ui_recvmsg function in net/llc/af_llc.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:59661157235368080846953763275958093808
title: CVE-2013-3234 linux
description:
The rose_recvmsg function in net/rose/af_rose.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:178968207470175815036524761148971130675
title: CVE-2013-3235 linux
description:
net/tipc/socket.c in the Linux kernel before 3.9-rc7 does not initialize a certain data structure and a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:70541370680240911083351708682060165204
title: CVE-2013-3237 open-vm-tools
description:
The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c in the Linux kernel before 3.9-rc7 does not initialize a certain length variable, which allows local users to obtain sensitive information from kernel stack memory via a crafted recvmsg or recvfrom system call.


definition_id: oval:org.debian:def:97766226581445256896961909915869791685
title: CVE-2013-3245 vlc
description:
** DISPUTED ** plugins/demux/libmkv_plugin.dll in VideoLAN VLC Media Player 2.0.7, and possibly other versions, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted MKV file, possibly involving an integer overflow and out-of-bounds read or heap-based buffer overflow, or an uncaught exception.  NOTE: the vendor disputes the severity and claimed vulnerability type of this issue, stating "This PoC crashes VLC, indeed, but does nothing more... this is not an integer overflow error, but an uncaught exception and I doubt that it is exploitable. This uncaught exception makes VLC abort, not execute random code, on my Linux 64bits machine." A PoC posted by the original researcher shows signs of an attacker-controlled out-of-bounds read, but the affected instruction does not involve a register that directly influences control flow.


definition_id: oval:org.debian:def:152078349213327359039316549926192809349
title: CVE-2013-3302 linux
description:
Race condition in the smb_send_rqst function in fs/cifs/transport.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via vectors involving a reconnection event.


definition_id: oval:org.debian:def:18769853746945118212980848989593621589
title: CVE-2013-3368 request-tracker4
description:
bin/rt in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with predictable name.


definition_id: oval:org.debian:def:287246152164319790581219007087588040426
title: CVE-2013-3369 request-tracker4
description:
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote authenticated users with the permissions to view the administration pages to execute arbitrary private components via unspecified vectors.


definition_id: oval:org.debian:def:76440951717268080565590072645923493244
title: CVE-2013-3370 request-tracker4
description:
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 does not properly restrict access to private callback components, which allows remote attackers to have an unspecified impact via a direct request.


definition_id: oval:org.debian:def:174620126436531433419761258204350491515
title: CVE-2013-3371 request-tracker4
description:
Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 3.8.3 through 3.8.16 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary web script or HTML via the filename of an attachment.


definition_id: oval:org.debian:def:103013683820568353354819017330194022755
title: CVE-2013-3372 request-tracker4
description:
Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject multiple Content-Disposition HTTP headers and possibly conduct cross-site scripting (XSS) attacks via unspecified vectors.


definition_id: oval:org.debian:def:230576547615646944227658317598581851959
title: CVE-2013-3373 request-tracker4
description:
CRLF injection vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a MIME header.


definition_id: oval:org.debian:def:250828232516069993051732839085250932651
title: CVE-2013-3374 request-tracker4
description:
Unspecified vulnerability in Request Tracker (RT) 3.8.x before 3.8.17 and 4.0.x before 4.0.13, when using the Apache::Session::File session store, allows remote attackers to obtain sensitive information (user preferences and caches) via unknown vectors, related to a "limited session re-use."


definition_id: oval:org.debian:def:51279001071083848595086449279127620877
title: CVE-2013-3495 xen
description:
The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4.3.x allows local guests to cause a denial of service (kernel panic) via a malformed Message Signaled Interrupt (MSI) from a PCI device that is bus mastering capable that triggers a System Error Reporting (SERR) Non-Maskable Interrupt (NMI).


definition_id: oval:org.debian:def:277411154717557363652299399701474062892
title: CVE-2013-3551 otrs2
description:
Kernel/Modules/AgentTicketPhone.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.20, 3.1.x before 3.1.16, and 3.2.x before 3.2.7, and OTRS ITSM 3.0.x before 3.0.8, 3.1.x before 3.1.9, and 3.2.x before 3.2.5 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.


definition_id: oval:org.debian:def:203775109334026490267688367280811067467
title: CVE-2013-3555 wireshark
description:
epan/dissectors/packet-gtpv2.c in the GTPv2 dissector in Wireshark 1.8.x before 1.8.7 calls incorrect functions in certain contexts related to ciphers, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:103268332773915559847706174992189313979
title: CVE-2013-3557 wireshark
description:
The dissect_ber_choice function in epan/dissectors/packet-ber.c in the ASN.1 BER dissector in Wireshark 1.6.x before 1.6.15 and 1.8.x before 1.8.7 does not properly initialize a certain variable, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:28003531545363151961754503339117075051
title: CVE-2013-3558 wireshark
description:
The dissect_ccp_bsdcomp_opt function in epan/dissectors/packet-ppp.c in the PPP CCP dissector in Wireshark 1.8.x before 1.8.7 does not terminate a bit-field list, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:238669279754711709973451285405229081890
title: CVE-2013-3559 wireshark
description:
epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.8.x before 1.8.7 uses incorrect integer data types, which allows remote attackers to cause a denial of service (integer overflow, and heap memory corruption or NULL pointer dereference, and application crash) via a malformed packet.


definition_id: oval:org.debian:def:37648502873823944570190216410936840415
title: CVE-2013-3560 wireshark
description:
The dissect_dsmcc_un_download function in epan/dissectors/packet-mpeg-dsmcc.c in the MPEG DSM-CC dissector in Wireshark 1.8.x before 1.8.7 uses an incorrect format string, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:3916677596976419246934127244970310175
title: CVE-2013-3562 wireshark
description:
Multiple integer signedness errors in the tvb_unmasked function in epan/dissectors/packet-websocket.c in the Websocket dissector in Wireshark 1.8.x before 1.8.7 allow remote attackers to cause a denial of service (application crash) via a malformed packet.


definition_id: oval:org.debian:def:136800929565754234051051644646488118600
title: CVE-2013-3564 vlc
description:
The web interface in VideoLAN VLC media player before 2.0.7 has no access control which allows remote attackers to view directory listings via the 'dir' command or issue other commands without authenticating.


definition_id: oval:org.debian:def:26252728149239839389854793638779239819
title: CVE-2013-3565 vlc
description:
Multiple cross-site scripting (XSS) vulnerabilities in the HTTP Interface in VideoLAN VLC Media Player before 2.0.7 allow remote attackers to inject arbitrary web script or HTML via the (1) command parameter to requests/vlm_cmd.xml, (2) dir parameter to requests/browse.xml, or (3) URI in a request, which is returned in an error message through share/lua/intf/http.lua.


definition_id: oval:org.debian:def:305229517210714601815530363191062764759
title: CVE-2013-3567 puppet
description:
Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2, and Puppet Enterprise before 2.8.2, deserializes untrusted YAML, which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.


definition_id: oval:org.debian:def:163941574815840763200052572195182534283
title: CVE-2013-3571 socat
description:
socat 1.2.0.0 before 1.7.2.2 and 2.0.0-b1 before 2.0.0-b6, when used for a listen type address and the fork option is enabled, allows remote attackers to cause a denial of service (file descriptor consumption) via multiple request that are refused based on the (1) sourceport, (2) lowport, (3) range, or (4) tcpwrap restrictions.


definition_id: oval:org.debian:def:197300708150798567602540200749578374034
title: CVE-2013-3670 ffmpeg
description:
The rle_unpack function in vmdav.c in libavcodec in FFmpeg git 20130328 through 20130501 does not properly use the bytestream2 API, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted RLE data.  NOTE: the vendor has listed this as an issue fixed in 1.2.1, but the issue is actually in new code that was not shipped with the 1.2.1 release or any earlier release.


definition_id: oval:org.debian:def:175921547368555001584665512481566136126
title: CVE-2013-3672 ffmpeg
description:
The mm_decode_inter function in mmvideo.c in libavcodec in FFmpeg before 1.2.1 does not validate the relationship between a horizontal coordinate and a width value, which allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) via crafted American Laser Games (ALG) MM Video data.


definition_id: oval:org.debian:def:278235941226194596717576401312582779584
title: CVE-2013-3738 zabbix
description:
A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts, which could let a remote malicious user execute arbitrary code.


definition_id: oval:org.debian:def:177943144186566817025784862952306762400
title: CVE-2013-4074 wireshark
description:
The dissect_capwap_data function in epan/dissectors/packet-capwap.c in the CAPWAP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 incorrectly uses a -1 data value to represent an error condition, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:269357780960929295606552582641262913805
title: CVE-2013-4075 wireshark
description:
epan/dissectors/packet-gmr1_bcch.c in the GMR-1 BCCH dissector in Wireshark 1.8.x before 1.8.8 does not properly initialize memory, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:221512689705021686368994373556311530904
title: CVE-2013-4076 wireshark
description:
Buffer overflow in the dissect_iphc_crtp_fh function in epan/dissectors/packet-ppp.c in the PPP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:232003763432329440974907125585119695421
title: CVE-2013-4077 wireshark
description:
Array index error in the NBAP dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (application crash) via a crafted packet, related to nbap.cnf and packet-nbap.c.


definition_id: oval:org.debian:def:267556732606031734417912601502307911651
title: CVE-2013-4078 wireshark
description:
epan/dissectors/packet-rdp.c in the RDP dissector in Wireshark 1.8.x before 1.8.8 does not validate return values during checks for data availability, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:271820293839584982557249890032259489356
title: CVE-2013-4079 wireshark
description:
The dissect_schedule_message function in epan/dissectors/packet-gsm_cbch.c in the GSM CBCH dissector in Wireshark 1.8.x before 1.8.8 allows remote attackers to cause a denial of service (infinite loop and application hang) via a crafted packet.


definition_id: oval:org.debian:def:320644536397596516028859907896688826215
title: CVE-2013-4080 wireshark
description:
The dissect_r3_upstreamcommand_queryconfig function in epan/dissectors/packet-assa_r3.c in the Assa Abloy R3 dissector in Wireshark 1.8.x before 1.8.8 does not properly handle a zero-length item, which allows remote attackers to cause a denial of service (infinite loop, and CPU and memory consumption) via a crafted packet.


definition_id: oval:org.debian:def:247746626995708137283033385409875696121
title: CVE-2013-4081 wireshark
description:
The http_payload_subdissector function in epan/dissectors/packet-http.c in the HTTP dissector in Wireshark 1.6.x before 1.6.16 and 1.8.x before 1.8.8 does not properly determine when to use a recursive approach, which allows remote attackers to cause a denial of service (stack consumption) via a crafted packet.


definition_id: oval:org.debian:def:152386784181266098154045956490498825596
title: CVE-2013-4082 wireshark
description:
The vwr_read function in wiretap/vwr.c in the Ixia IxVeriWave file parser in Wireshark 1.8.x before 1.8.8 does not validate the relationship between a record length and a trailer length, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted packet.


definition_id: oval:org.debian:def:31818091806785215578246389394642930438
title: CVE-2013-4083 wireshark
description:
The dissect_pft function in epan/dissectors/packet-dcp-etsi.c in the DCP ETSI dissector in Wireshark 1.6.x before 1.6.16, 1.8.x before 1.8.8, and 1.10.0 does not validate a certain fragment length value, which allows remote attackers to cause a denial of service (application crash) via a crafted packet.


definition_id: oval:org.debian:def:155284261745951189554969414235807866090
title: CVE-2013-4088 otrs2
description:
Kernel/Modules/AgentTicketWatcher.pm in Open Ticket Request System (OTRS) 3.0.x before 3.0.21, 3.1.x before 3.1.17, and 3.2.x before 3.2.8 does not properly restrict tickets, which allows remote attackers with a valid agent login to read restricted tickets via a crafted URL involving the ticket split mechanism.


definition_id: oval:org.debian:def:5608252428163551164255871630130086764
title: CVE-2013-4112 libjgroups-java
description:
The DiagnosticsHandler in JGroup 3.0.x, 3.1.x, 3.2.x before 3.2.9, and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.


definition_id: oval:org.debian:def:327581749820193049047854508801512174505
title: CVE-2013-4114 nagstamon
description:
The automatic update request in Nagstamont before 0.9.10 uses a cleartext base64 format for transmission of a username and password, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:266310036328272149363522268160154172514
title: CVE-2013-4116 npm
description:
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.


definition_id: oval:org.debian:def:46628623400401708970143788780111100015
title: CVE-2013-4122 cyrus-sasl2
description:
Cyrus SASL 2.1.23, 2.1.26, and earlier does not properly handle when a NULL value is returned upon an error by the crypt function as implemented in glibc 2.17 and later, which allows remote attackers to cause a denial of service (thread crash and consumption) via (1) an invalid salt or, when FIPS-140 is enabled, a (2) DES or (3) MD5 encrypted password, which triggers a NULL pointer dereference.


definition_id: oval:org.debian:def:147853513302554753559709619054270051274
title: CVE-2013-4124 samba
description:
Integer overflow in the read_nttrans_ea_list function in nttrans.c in smbd in Samba 3.x before 3.5.22, 3.6.x before 3.6.17, and 4.x before 4.0.8 allows remote attackers to cause a denial of service (memory consumption) via a malformed packet.


definition_id: oval:org.debian:def:330875308656744317330562625910658204349
title: CVE-2013-4125 linux
description:
The fib6_add_rt2node function in net/ipv6/ip6_fib.c in the IPv6 stack in the Linux kernel through 3.10.1 does not properly handle Router Advertisement (RA) messages in certain circumstances involving three routes that initially qualified for membership in an ECMP route set until a change occurred for one of the first two routes, which allows remote attackers to cause a denial of service (system crash) via a crafted sequence of messages.


definition_id: oval:org.debian:def:216850503370782063890089869086320752070
title: CVE-2013-4127 linux
description:
Use-after-free vulnerability in the vhost_net_set_backend function in drivers/vhost/net.c in the Linux kernel through 3.10.3 allows local users to cause a denial of service (OOPS and system crash) via vectors involving powering on a virtual machine.


definition_id: oval:org.debian:def:135071519628589501426035758324076259585
title: CVE-2013-4130 spice
description:
The (1) red_channel_pipes_add_type and (2) red_channel_pipes_add_empty_msg functions in server/red_channel.c in SPICE before 0.12.4 do not properly perform ring loops, which might allow remote attackers to cause a denial of service (reachable assertion and server exit) by triggering a network error.


definition_id: oval:org.debian:def:170070381530047222279889330854326182620
title: CVE-2013-4131 subversion
description:
The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.10 and 1.8.x before 1.8.1 allows remote authenticated users to cause a denial of service (assertion failure or out-of-bounds read) via a certain (1) COPY, (2) DELETE, or (3) MOVE request against a revision root.


definition_id: oval:org.debian:def:105016993981634217859177818440102131519
title: CVE-2013-4134 openafs
description:
OpenAFS before 1.4.15, 1.6.x before 1.6.5, and 1.7.x before 1.7.26 uses weak encryption (DES) for Kerberos keys, which makes it easier for remote attackers to obtain the service key.


definition_id: oval:org.debian:def:291800488955721759167712034024293511815
title: CVE-2013-4135 openafs
description:
The vos command in OpenAFS 1.6.x before 1.6.5, when using the -encrypt option, only enables integrity protection and sends data in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:96953156577672145870598007539578419763
title: CVE-2013-4136 passenger
description:
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.


definition_id: oval:org.debian:def:149283140118206881050775444209946058201
title: CVE-2013-4152 libspring-java
description:
The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.


definition_id: oval:org.debian:def:299697202267844972208676425643004439787
title: CVE-2013-4153 libvirt
description:
Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows remote attackers to cause a denial of service (daemon crash) via a cpu count request, as demonstrated by the "virsh vcpucount dom --guest" command.


definition_id: oval:org.debian:def:222141520202728839113039610396189304576
title: CVE-2013-4154 libvirt
description:
The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to "agent based cpu (un)plug," as demonstrated by the "virsh vcpucount foobar --guest" command.


definition_id: oval:org.debian:def:42273869484744378493824526901114935209
title: CVE-2013-4155 swift
description:
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.


definition_id: oval:org.debian:def:271134754017414927869095492699349650733
title: CVE-2013-4156 libreoffice
description:
Apache OpenOffice.org (OOo) before 4.0 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted element in an OOXML document file.


definition_id: oval:org.debian:def:645040952640935891036741109029151944
title: CVE-2013-4160 lcms2
description:
Little CMS (lcms2) before 2.5, as used in OpenJDK 7 and possibly other products, allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to (1) cmsStageAllocLabV2ToV4curves, (2) cmsPipelineDup, (3) cmsAllocProfileSequenceDescription, (4) CurvesAlloc, and (5) cmsnamed.


definition_id: oval:org.debian:def:153084648884146557395278642413290276551
title: CVE-2013-4162 linux
description:
The udp_v6_push_pending_frames function in net/ipv6/udp.c in the IPv6 implementation in the Linux kernel through 3.10.3 makes an incorrect function call for pending data, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.


definition_id: oval:org.debian:def:56616329838948863595341847150653981871
title: CVE-2013-4163 linux
description:
The ip6_append_data_mtu function in net/ipv6/ip6_output.c in the IPv6 implementation in the Linux kernel through 3.10.3 does not properly maintain information about whether the IPV6_MTU setsockopt option had been specified, which allows local users to cause a denial of service (BUG and system crash) via a crafted application that uses the UDP_CORK option in a setsockopt system call.


definition_id: oval:org.debian:def:7380694310603073850116849675242134737
title: CVE-2013-4173 xymon
description:
Directory traversal vulnerability in the trend-data daemon (xymond_rrd) in Xymon 4.x before 4.3.12 allows remote attackers to delete arbitrary files via a .. (dot dot) in the host name in a "drophost" command.


definition_id: oval:org.debian:def:12877040384264038507374164269551762861
title: CVE-2013-4183 cinder
description:
The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.


definition_id: oval:org.debian:def:112014208508664015856632065141997944393
title: CVE-2013-4185 nova
description:
Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.


definition_id: oval:org.debian:def:72143433097017121340752622984329967308
title: CVE-2013-4202 cinder
description:
The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.


definition_id: oval:org.debian:def:97489681217903057803459973438502304364
title: CVE-2013-4205 linux
description:
Memory leak in the unshare_userns function in kernel/user_namespace.c in the Linux kernel before 3.10.6 allows local users to cause a denial of service (memory consumption) via an invalid CLONE_NEWUSER unshare call.


definition_id: oval:org.debian:def:320456137030263824772096513791677821940
title: CVE-2013-4206 filezilla
description:
Heap-based buffer underflow in the modmul function in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) and possibly trigger memory corruption or code execution via a crafted DSA signature, which is not properly handled when performing certain bit-shifting operations during modular multiplication.


definition_id: oval:org.debian:def:299674765962278352126690282029971470100
title: CVE-2013-4207 filezilla
description:
Buffer overflow in sshbn.c in PuTTY before 0.63 allows remote SSH servers to cause a denial of service (crash) via an invalid DSA signature that is not properly handled during computation of a modular inverse and triggers the overflow during a division by zero by the bignum functionality, a different vulnerability than CVE-2013-4206.


definition_id: oval:org.debian:def:96481649722694761341751910706728501568
title: CVE-2013-4208 filezilla
description:
The rsa_verify function in PuTTY before 0.63 (1) does not clear sensitive process memory after use and (2) does not free certain structures containing sensitive process memory, which might allow local users to discover private RSA and DSA keys.


definition_id: oval:org.debian:def:164091904418831192995012681036518392870
title: CVE-2013-4223 nullmailer
description:
The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file.


definition_id: oval:org.debian:def:15525449416335685468003561185347862136
title: CVE-2013-4231 tiff
description:
Multiple buffer overflows in libtiff before 4.0.3 allow remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) extension block in a GIF image or (2) GIF raster image to tools/gif2tiff.c or (3) a long filename for a TIFF image to tools/rgb2ycbcr.c.  NOTE: vectors 1 and 3 are disputed by Red Hat, which states that the input cannot exceed the allocated buffer size.


definition_id: oval:org.debian:def:286831910203172061862801801551282068366
title: CVE-2013-4233 libmodplug
description:
Integer overflow in the abc_set_parts function in load_abc.cpp in libmodplug 0.8.8.4 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted P header in an ABC file, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:271005608142197157422045533330961565728
title: CVE-2013-4234 libmodplug
description:
Multiple heap-based buffer overflows in the (1) abc_MIDI_drum and (2) abc_MIDI_gchord functions in load_abc.cpp in libmodplug 0.8.8.4 and earlier allow remote attackers to cause a denial of service (memory corruption and crash) and possibly execute arbitrary code via a crafted ABC.


definition_id: oval:org.debian:def:118694263653604314802506735649456311126
title: CVE-2013-4237 glibc
description:
An out-of-bounds write flaw was found in the way the glibc's readdir_r() function handled file system entries longer than the NAME_MAX character constant. A remote attacker could provide a specially crafted NTFS or CIFS file system that, when processed by an application using readdir_r(), would cause that application to crash or, potentially, allow the attacker to execute arbitrary code with the privileges of the user running the application.


definition_id: oval:org.debian:def:136477007610637450050739506304290602003
title: CVE-2013-4238 python2.7
description:
The ssl.match_hostname function in the SSL module in Python 2.6 through 3.4 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.


definition_id: oval:org.debian:def:2587645675152281398226965902417334995
title: CVE-2013-4239 libvirt
description:
The xenDaemonListDefinedDomains function in xen/xend_internal.c in libvirt 1.1.1 allows remote authenticated users to cause a denial of service (memory corruption and crash) via vectors involving the virConnectListDefinedDomains API function.


definition_id: oval:org.debian:def:336893616838269963631231943912412224848
title: CVE-2013-4247 linux
description:
Off-by-one error in the build_unc_path_to_root function in fs/cifs/connect.c in the Linux kernel before 3.9.6 allows remote attackers to cause a denial of service (memory corruption and system crash) via a DFS share mount operation that triggers use of an unexpected DFS referral name length.


definition_id: oval:org.debian:def:334045287312616482511081050913178820991
title: CVE-2013-4249 python-django
description:
Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField.


definition_id: oval:org.debian:def:311999954531639793799391674614426644893
title: CVE-2013-4254 linux
description:
The validate_event function in arch/arm/kernel/perf_event.c in the Linux kernel before 3.10.8 on the ARM platform allows local users to gain privileges or cause a denial of service (NULL pointer dereference and system crash) by adding a hardware event to an event group led by a software event.


definition_id: oval:org.debian:def:14761468397298645310376856884347768025
title: CVE-2013-4255 condor
description:
The policy definition evaluator in Condor 7.5.4, 8.0.0, and earlier does not properly handle attributes in a (1) PREEMPT, (2) SUSPEND, (3) CONTINUE, (4) WANT_VACATE, or (5) KILL policy that evaluate to an Unconfigured, Undefined, or Error state, which allows remote authenticated users to cause a denial of service (condor_startd exit) via a crafted job.


definition_id: oval:org.debian:def:86193084785479515147421580347554106610
title: CVE-2013-4256 nas
description:
Multiple stack-based and heap-based buffer overflows in Network Audio System (NAS) 1.9.3 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via the (1) display command argument to the ProcessCommandLine function in server/os/utils.c; (2) ResetHosts function in server/os/access.c; (3) open_unix_socket, (4) open_isc_local, (5) open_xsight_local, (6) open_att_local, or (7) open_att_svr4_local function in server/os/connection.c; the (8) AUDIOHOST environment variable to the CreateWellKnownSockets or (9) AmoebaTCPConnectorThread function in server/os/connection.c; or (10) unspecified vectors related to logging in the osLogMsg function in server/os/aulog.c.


definition_id: oval:org.debian:def:64819685206093834513791928025783282842
title: CVE-2013-4258 nas
description:
Format string vulnerability in the osLogMsg function in server/os/aulog.c in Network Audio System (NAS) 1.9.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in unspecified vectors, related to syslog.


definition_id: oval:org.debian:def:283859714850785969420254752806456624012
title: CVE-2013-4259 ansible
description:
runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.


definition_id: oval:org.debian:def:215980217446896430280165004209509572763
title: CVE-2013-4261 nova
description:
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.


definition_id: oval:org.debian:def:63167580070981943547688700569449276811
title: CVE-2013-4262 subversion
description:
svnwcsub.py in Subversion 1.8.0 before 1.8.3, when using the --pidfile option and running in foreground mode, allows local users to gain privileges via a symlink attack on the pid file.  NOTE: this issue was SPLIT due to different affected versions (ADT3). The irkerbridge.py issue is covered by CVE-2013-7393.


definition_id: oval:org.debian:def:29022412582249048097819881207149608559
title: CVE-2013-4270 linux
description:
The net_ctl_permissions function in net/sysctl_net.c in the Linux kernel before 3.11.5 does not properly determine uid and gid values, which allows local users to bypass intended /proc/sys/net restrictions via a crafted application.


definition_id: oval:org.debian:def:126859225257731849555147543133960282728
title: CVE-2013-4277 subversion
description:
Svnserve in Apache Subversion 1.4.0 through 1.7.12 and 1.8.0 through 1.8.1 allows local users to overwrite arbitrary files or kill arbitrary processes via a symlink attack on the file specified by the --pid-file option.


definition_id: oval:org.debian:def:48246504364650776201464983801051069834
title: CVE-2013-4278 nova
description:
The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.  NOTE: this issue is due to an incomplete fix for CVE-2013-2256.


definition_id: oval:org.debian:def:125618461720438616747540328945390258430
title: CVE-2013-4283 389-ds-base
description:
ns-slapd in 389 Directory Server before 1.3.0.8 allows remote attackers to cause a denial of service (server crash) via a crafted Distinguished Name (DN) in a MOD operation request.


definition_id: oval:org.debian:def:151827820559230954468893032295050554949
title: CVE-2013-4291 libvirt
description:
The virSecurityManagerSetProcessLabel function in libvirt 0.10.2.7, 1.0.5.5, and 1.1.1, when the domain has read an uid:gid label, does not properly set group memberships, which allows local users to gain privileges.


definition_id: oval:org.debian:def:137605409114099458564313418202316878827
title: CVE-2013-4292 libvirt
description:
libvirt 1.1.0 and 1.1.1 allows local users to cause a denial of service (memory consumption) via a large number of domain migrate parameters in certain RPC calls in (1) daemon/remote.c and (2) remote/remote_driver.c.


definition_id: oval:org.debian:def:98558034565916060909457509059567141222
title: CVE-2013-4296 libvirt
description:
The remoteDispatchDomainMemoryStats function in daemon/remote.c in libvirt 0.9.1 through 0.10.1.x, 0.10.2.x before 0.10.2.8, 1.0.x before 1.0.5.6, and 1.1.x before 1.1.2 allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via a crafted RPC call.


definition_id: oval:org.debian:def:163654184745523866167940487453773235607
title: CVE-2013-4297 libvirt
description:
The virFileNBDDeviceAssociate function in util/virfile.c in libvirt 1.1.2 and earlier allows remote authenticated users to cause a denial of service (uninitialized pointer dereference and crash) via unspecified vectors.


definition_id: oval:org.debian:def:316762480732400363771814677157908911245
title: CVE-2013-4298 imagemagick
description:
The ReadGIFImage function in coders/gif.c in ImageMagick before 6.7.8-8 allows remote attackers to cause a denial of service (memory corruption and application crash) via a crafted comment in a GIF image.


definition_id: oval:org.debian:def:313893185897133600908300522360685737009
title: CVE-2013-4299 linux
description:
Interpretation conflict in drivers/md/dm-snap-persistent.c in the Linux kernel through 3.11.6 allows remote authenticated users to obtain sensitive information or modify data via a crafted mapping to a snapshot block device.


definition_id: oval:org.debian:def:329904493456694520433581125053888880002
title: CVE-2013-4300 linux
description:
The scm_check_creds function in net/core/scm.c in the Linux kernel before 3.11 performs a capability check in an incorrect namespace, which allows local users to gain privileges via PID spoofing.


definition_id: oval:org.debian:def:118764042043181707263943386522866312579
title: CVE-2013-4301 mediawiki
description:
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.


definition_id: oval:org.debian:def:316530651079613792702394014190792021358
title: CVE-2013-4302 mediawiki
description:
(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php, (4) ApiMain.php, (5) ApiQueryDeletedrevs.php, (6) ApiTokens.php, and (7) ApiUnblock.php in includes/api/ in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allow remote attackers to obtain CSRF tokens and bypass the cross-site request forgery (CSRF) protection mechanism via a JSONP request to wiki/api.php.


definition_id: oval:org.debian:def:6934492950404890656335399999678282696
title: CVE-2013-4303 mediawiki
description:
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.


definition_id: oval:org.debian:def:174233630865290114065387032644889125747
title: CVE-2013-4311 libvirt
description:
libvirt 1.0.5.x before 1.0.5.6, 0.10.2.x before 0.10.2.8, and 0.9.12.x before 0.9.12.2 allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition in pkcheck via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:161522940668900163162586806248473262157
title: CVE-2013-4312 linux
description:
It was found that the Linux kernel did not properly account file descriptors passed over the unix socket against the process limit. A local user could use this flaw to exhaust all available memory on the system.


definition_id: oval:org.debian:def:38416018277329091987290744508380222714
title: CVE-2013-4314 pyopenssl
description:
The X509Extension in pyOpenSSL before 0.13.1 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.


definition_id: oval:org.debian:def:243502545135442607490035348904678181251
title: CVE-2013-4315 python-django
description:
Directory traversal vulnerability in Django 1.4.x before 1.4.7, 1.5.x before 1.5.3, and 1.6.x before 1.6 beta 3 allows remote attackers to read arbitrary files via a file path in the ALLOWED_INCLUDE_ROOTS setting followed by a .. (dot dot) in a ssi template tag.


definition_id: oval:org.debian:def:136895823740414852417698287473262428275
title: CVE-2013-4324 spice-gtk
description:
spice-gtk 0.14, and possibly other versions, invokes the polkit authority using the insecure polkit_unix_process_new API function, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:16923032080705264967509735315305559257
title: CVE-2013-4325 hplip
description:
The check_permission_v1 function in base/pkit.py in HP Linux Imaging and Printing (HPLIP) through 3.13.9 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process.


definition_id: oval:org.debian:def:314613213518161893370892777035814776524
title: CVE-2013-4326 rtkit
description:
RealtimeKit (aka rtkit) 0.5 does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:117651919383149886480811128338399884991
title: CVE-2013-4327 systemd
description:
systemd does not properly use D-Bus for communication with a polkit authority, which allows local users to bypass intended access restrictions by leveraging a PolkitUnixProcess PolkitSubject race condition via a (1) setuid process or (2) pkexec process, a related issue to CVE-2013-4288.


definition_id: oval:org.debian:def:157243111441431841971280149579106457003
title: CVE-2013-4329 xen
description:
The xenlight library (libxl) in Xen 4.0.x through 4.2.x, when IOMMU is disabled, provides access to a busmastering-capable PCI passthrough device before the IOMMU setup is complete, which allows local HVM guest domains to gain privileges or cause a denial of service via a DMA instruction.


definition_id: oval:org.debian:def:176374055578699596243985759497738081668
title: CVE-2013-4331 lightdm
description:
Light Display Manager (aka LightDM) 1.4.x before 1.4.3, 1.6.x before 1.6.2, and 1.7.x before 1.7.14 uses 0664 permissions for the temporary .Xauthority file, which allows local users to obtain sensitive information by reading the file.


definition_id: oval:org.debian:def:193515926456912516319325864163845610066
title: CVE-2013-4332 glibc
description:
Multiple integer overflow flaws, leading to heap-based buffer overflows, were found in glibc's memory allocator functions (pvalloc, valloc, and memalign). If an application used such a function, it could cause the application to crash or, potentially, execute arbitrary code with the privileges of the user running the application.


definition_id: oval:org.debian:def:74406039292225245587453737896655353916
title: CVE-2013-4338 wordpress
description:
wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.


definition_id: oval:org.debian:def:339135788141141782258956039546705222789
title: CVE-2013-4339 wordpress
description:
WordPress before 3.6.1 does not properly validate URLs before use in an HTTP redirect, which allows remote attackers to bypass intended redirection restrictions via a crafted string.


definition_id: oval:org.debian:def:255117036495477192534286625025024119786
title: CVE-2013-4340 wordpress
description:
wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified user_ID parameter.


definition_id: oval:org.debian:def:43777716355926991324625120889089900566
title: CVE-2013-4344 qemu
description:
Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.


definition_id: oval:org.debian:def:50058064079183024627471335614602005400
title: CVE-2013-4350 linux
description:
The IPv6 SCTP implementation in net/sctp/ipv6.c in the Linux kernel through 3.11.1 uses data structures and function calls that do not trigger an intended configuration of IPsec encryption, which allows remote attackers to obtain sensitive information by sniffing the network.


definition_id: oval:org.debian:def:194030715614983887862083901091646724646
title: CVE-2013-4351 gnupg2
description:
GnuPG 1.4.x, 2.0.x, and 2.1.x treats a key flags subpacket with all bits cleared (no usage permitted) as if it has all bits set (all usage permitted), which might allow remote attackers to bypass intended cryptographic protection mechanisms by leveraging the subkey.


definition_id: oval:org.debian:def:125369296827456558453522398714324690476
title: CVE-2013-4352 apache2
description:
The cache_invalidate function in modules/cache/cache_storage.c in the mod_cache module in the Apache HTTP Server 2.4.6, when a caching forward proxy is enabled, allows remote HTTP servers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger a missing hostname value.


definition_id: oval:org.debian:def:196289982881589230305848716736640202913
title: CVE-2013-4353 openssl
description:
The ssl3_take_mac function in ssl/s3_both.c in OpenSSL 1.0.1 before 1.0.1f allows remote TLS servers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Next Protocol Negotiation record in a TLS handshake.


definition_id: oval:org.debian:def:177240130948436159745928463002482735714
title: CVE-2013-4356 xen
description:
Xen 4.3.x writes hypervisor mappings to certain shadow pagetables when live migration is performed on hosts with more than 5TB of RAM, which allows local 64-bit PV guests to read or write to invalid memory and cause a denial of service (crash).


definition_id: oval:org.debian:def:239106084182593375575896344228376725083
title: CVE-2013-4359 proftpd-dfsg
description:
Integer overflow in kbdint.c in mod_sftp in ProFTPD 1.3.4d and 1.3.5r3 allows remote attackers to cause a denial of service (memory consumption) via a large response count value in an authentication request, which triggers a large memory allocation.


definition_id: oval:org.debian:def:161365188380394755608346045932404612677
title: CVE-2013-4361 xen
description:
The fbld instruction emulation in Xen 3.3.x through 4.3.x does not use the correct variable for the source effective address, which allows local HVM guests to obtain hypervisor stack information by reading the values used by the instruction.


definition_id: oval:org.debian:def:136261837320681124646608516303078989358
title: CVE-2013-4362 davfs2
description:
WEB-DAV Linux File System (davfs2) 1.4.6 and 1.4.7 allow local users to gain privileges via unknown attack vectors in (1) kernel_interface.c and (2) mount_davfs.c, related to the "system" function.


definition_id: oval:org.debian:def:88304482825325973853593954794351250312
title: CVE-2013-4365 libapache2-mod-fcgid
description:
Heap-based buffer overflow in the fcgid_header_bucket_read function in fcgid_bucket.c in the mod_fcgid module before 2.3.9 for the Apache HTTP Server allows remote attackers to have an unspecified impact via unknown vectors.


definition_id: oval:org.debian:def:332078248306188433081243267197539112971
title: CVE-2013-4366 httpcomponents-client
description:
http/impl/client/HttpClientBuilder.java in Apache HttpClient 4.3.x before 4.3.1 does not ensure that X509HostnameVerifier is not null, which allows attackers to have unspecified impact via vectors involving hostname verification.


definition_id: oval:org.debian:def:63634117898625541124205706627622294325
title: CVE-2013-4368 xen
description:
The outs instruction emulation in Xen 3.1.x, 4.2.x, 4.3.x, and earlier, when using FS: or GS: segment override, uses an uninitialized variable as a segment base, which allows local 64-bit PV guests to obtain sensitive information (hypervisor stack content) via unspecified vectors related to stale data in a segment register.


definition_id: oval:org.debian:def:75168344386512193486068489606812501606
title: CVE-2013-4369 xen
description:
The xlu_vif_parse_rate function in the libxlu library in Xen 4.2.x and 4.3.x allows local users to cause a denial of service (NULL pointer dereference) by using the "@" character as the VIF rate configuration.


definition_id: oval:org.debian:def:114968901498772982794761414772070075849
title: CVE-2013-4370 xen
description:
The ocaml binding for the xc_vcpu_getaffinity function in Xen 4.2.x and 4.3.x frees certain memory that may still be intended for use, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors that trigger a (1) use-after-free or (2) double free.


definition_id: oval:org.debian:def:201515152724005691467134019383292405542
title: CVE-2013-4371 xen
description:
Use-after-free vulnerability in the libxl_list_cpupool function in the libxl toolstack library in Xen 4.2.x and 4.3.x, when running "under memory pressure," returns the original pointer when the realloc function fails, which allows local users to cause a denial of service (heap corruption and crash) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:313136989303580769727478233796136890367
title: CVE-2013-4375 qemu
description:
The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.


definition_id: oval:org.debian:def:203364765650877661956837242712385118885
title: CVE-2013-4377 qemu
description:
Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.


definition_id: oval:org.debian:def:215491282883799518945459556064433718866
title: CVE-2013-4385 chicken
description:
Buffer overflow in the "read-string!" procedure in the "extras" unit in CHICKEN stable before 4.8.0.5 and development snapshots before 4.8.3 allows remote attackers to cause a denial of service (memory corruption and application crash) and possibly execute arbitrary code via a "#f" value in the NUM argument.


definition_id: oval:org.debian:def:174103225101126276620761008324968838279
title: CVE-2013-4388 vlc
description:
Buffer overflow in the mp4a packetizer (modules/packetizer/mpeg4audio.c) in VideoLAN VLC Media Player before 2.0.8 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


definition_id: oval:org.debian:def:140979322479895446025196569844144732023
title: CVE-2013-4391 systemd
description:
Integer overflow in the valid_user_field function in journal/journald-native.c in systemd allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large journal data field, which triggers a heap-based buffer overflow.


definition_id: oval:org.debian:def:144130796613410611447264349598581519188
title: CVE-2013-4393 systemd
description:
journald in systemd, when the origin of native messages is set to file, allows local users to cause a denial of service (logging service blocking) via a crafted file descriptor.


definition_id: oval:org.debian:def:197159607083164451882230363873780306537
title: CVE-2013-4394 systemd
description:
The SetX11Keyboard function in systemd, when PolicyKit Local Authority (PKLA) is used to change the group permissions on the X Keyboard Extension (XKB) layouts description, allows local users in the group to modify the Xorg X11 Server configuration file and possibly gain privileges via vectors involving "special and control characters."


definition_id: oval:org.debian:def:37642371164607640900206694588474625743
title: CVE-2013-4396 xorg-server
description:
Use-after-free vulnerability in the doImageText function in dix/dixfonts.c in the xorg-server module before 1.14.4 in X.Org X11 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted ImageText request that triggers memory-allocation failure.


definition_id: oval:org.debian:def:316203964940651709609739728449691613063
title: CVE-2013-4399 libvirt
description:
The remoteClientFreeFunc function in daemon/remote.c in libvirt before 1.1.3, when ACLs are used, does not set an identity, which causes event handler removal to be denied and remote attackers to cause a denial of service (use-after-free and crash) by registering an event handler and then closing the connection.


definition_id: oval:org.debian:def:247537350925993569302876010436183371231
title: CVE-2013-4400 libvirt
description:
virt-login-shell in libvirt 1.1.2 through 1.1.3 allows local users to overwrite arbitrary files and possibly gain privileges via unspecified environment variables or command-line arguments.


definition_id: oval:org.debian:def:339558013485975790587271291644618798116
title: CVE-2013-4401 libvirt
description:
The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML.  NOTE: some of these details are obtained from third party information.


definition_id: oval:org.debian:def:195015477715026270858525424030542106833
title: CVE-2013-4402 gnupg2
description:
The compressed packet parser in GnuPG 1.4.x before 1.4.15 and 2.0.x before 2.0.22 allows remote attackers to cause a denial of service (infinite recursion) via a crafted OpenPGP message.


definition_id: oval:org.debian:def:308455241814142450099690509282739626012
title: CVE-2013-4407 libhttp-body-perl
description:
HTTP::Body::Multipart in the HTTP-Body 1.08, 1.17, and earlier module for Perl uses the part of the uploaded file's name after the first "." character as the suffix of a temporary file, which makes it easier for remote attackers to conduct attacks by leveraging subsequent behavior that may assume the suffix is well-formed.


definition_id: oval:org.debian:def:202069907100452468727390892608566463435
title: CVE-2013-4408 samba
description:
CVE-2013-4408 samba: Heap-based buffer overflow due to incorrect DCE-RPC fragment length field check


