Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2014-0019
Stack-based buffer overflow in socat 1.3.0.0 through 1.7.2.2 and 2.0.0-b1 through 2.0.0-b6 allows local users to cause a denial of service (segmentation fault) via a long server name in the PROXY-CONNECT address in the command line.
Affected Products: n/a
References: [{'name': 'FEDORA-2014-1795', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128229.html'}, {'name': 'MDVSA-2014:033', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:033'}, {'name': '65201', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65201'}, {'name': '102612', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102612'}, {'name': '[oss-security] 20140128 Socat security advisory 5 - PROXY-CONNECT address overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/159'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.dest-unreach.org/socat'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.dest-unreach.org/socat/contrib/socat-secadv5.txt'}, {'name': 'openSUSE-SU-2015:0760', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-04/msg00043.html'}, {'name': 'FEDORA-2014-1811', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128190.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0020
The IRC protocol plugin in libpurple in Pidgin before 2.10.8 does not validate argument counts, which allows remote IRC servers to cause a denial of service (application crash) via a crafted message.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2014:0326', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00005.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/a167504359e5'}, {'name': 'RHSA-2014:0139', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'https://rhn.redhat.com/errata/RHSA-2014-0139.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/9f132a6855cd'}, {'name': 'DSA-2859', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2859'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pidgin.im/news/security/?id=85'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/4d9be297d399'}, {'name': 'openSUSE-SU-2014:0239', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00039.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/6b0e0566af20'}, {'name': 'USN-2100-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2100-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/7d0fb0c6d8d4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://hg.pidgin.im/pidgin/main/rev/5845d9fa7084'}]
CVE State: PUBLISHED
Explain CVE-2014-0021
Chrony before 1.29.1 has traffic amplification in cmdmon protocol
Affected Products: Chrony
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-0021'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0021'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/18/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127837.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128753.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/17/9'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/18/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/18/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/19/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.securityfocus.com/bid/65035'}, {'tags': ['x_refsource_MISC'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90925'}]
CVE State: PUBLISHED
Explain CVE-2014-0022
The installUpdates function in yum-cron/yum-cron.py in yum 3.4.3 and earlier does not properly check the return value of the sigCheckPkg function, which allows remote attackers to bypass the RMP package signing restriction via an unsigned package.
Affected Products: n/a
References: [{'name': '65119', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65119'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://yum.baseurl.org/gitweb?p=yum.git%3Ba=commitdiff%3Bh=9df69e5794'}, {'name': '56637', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56637'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1052440'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1057377'}]
CVE State: PUBLISHED
Explain CVE-2014-0023
OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution
Affected Products: OpenShift
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0023'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0023'}]
CVE State: PUBLISHED
Explain CVE-2014-0026
katello-headpin is vulnerable to CSRF in REST API
Affected Products: katello-headpin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0026'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0026'}]
CVE State: PUBLISHED
Explain CVE-2014-0027
The play_wave_from_socket function in audio/auserver.c in Flite 1.4 allows local users to modify arbitrary files via a symlink attack on /tmp/awb.wav.  NOTE: some of these details are obtained from third party information.
Affected Products: n/a
References: [{'name': 'FEDORA-2014-0579', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127776.html'}, {'name': '64791', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/64791'}, {'name': 'MDVSA-2014:032', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:032'}, {'name': '101948', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/101948'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1048678'}, {'name': '[oss-security] 20140110 temporary file issue in flite', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/59'}, {'name': 'FEDORA-2014-0574', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127748.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0028
libvirt 1.1.1 through 1.2.0 allows context-dependent attackers to bypass the domain:getattr and connect:search_domains restrictions in ACLs and obtain sensitive domain object information via a request to the (1) virConnectDomainEventRegister and (2) virConnectDomainEventRegisterAny functions in the event registration API.
Affected Products: n/a
References: [{'name': 'USN-2093-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2093-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libvirt.org/news.html'}, {'name': '60895', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60895'}, {'name': 'GLSA-201412-04', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201412-04.xml'}, {'name': 'openSUSE-SU-2014:0268', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00060.html'}, {'name': '[libvirt] 20140115 [PATCH 0/4] CVE-2014-0028: domain events vs. ACL filtering', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://www.redhat.com/archives/libvir-list/2014-January/msg00684.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1048637'}]
CVE State: PUBLISHED
Explain CVE-2014-0029
Multiple cross-site scripting (XSS) vulnerabilities in the SAM web application in Red Hat katello-headpin allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059433'}]
CVE State: PUBLISHED
Explain CVE-2014-0030
The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.
Affected Products: n/a
References: [{'name': '45341', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/45341/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://liftsecurity.io/advisories/Apache_Roller_XML-RPC_susceptible_to_XXE/'}, {'name': '[roller-dev] 20140111 CVE-2014-0030 Apache Roller XML-RPC susceptible to XML Entended Entity attacks', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail-archives.apache.org/mod_mbox/roller-dev/201401.mbox/%3CCAF1aazCMzDGB12Ls4t-SOwNA=OdguD010LX3yZGhk2GQHafFXw%40mail.gmail.com%3E'}]
CVE State: PUBLISHED
Explain CVE-2014-0031
The (1) ListNetworkACL and (2) listNetworkACLLists APIs in Apache CloudStack before 4.2.1 allow remote authenticated users to list network ACLS for other users via a crafted request.
Affected Products: n/a
References: [{'name': '55960', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55960'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blogs.apache.org/cloudstack/entry/cve_2014_0031_cloudstack_listnetworkacl'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/CLOUDSTACK-5145'}]
CVE State: PUBLISHED
Explain CVE-2014-0032
The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/repos/asf/subversion/tags/1.8.6/CHANGES'}, {'name': '56822', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56822'}, {'name': '61321', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61321'}, {'name': 'USN-2316-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2316-1'}, {'name': '102927', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/102927'}, {'name': 'RHSA-2014:0255', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0255.html'}, {'name': '[subversion-dev] 20140110 2 Re: Segfault in mod_dav_svn with repositories on /', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C52D328AB.8090502%40reser.org%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?view=revision&revision=1557320'}, {'name': '65434', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65434'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6444'}, {'name': '[subversion-dev] 20140110 Sin mod_dav_svn with repositories on /', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=NiavGcobqvUuyhKyAA%40mail.gmail.com%3E'}, {'name': 'openSUSE-SU-2014:0307', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00086.html'}, {'name': '60722', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/60722'}, {'name': '[subversion-dev] 20140110 Re: Segfault in mod_dav_svn with repositories on /', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3C871u0gqb0d.fsf%40ntlworld.com%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/repos/asf/subversion/tags/1.7.15/CHANGES'}, {'name': 'apache-subversion-cve20140032-dos(90986)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/90986'}, {'name': 'openSUSE-SU-2014:0334', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00011.html'}, {'name': 'GLSA-201610-05', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/201610-05'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0036
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.
Affected Products: n/a
References: [{'name': 'FEDORA-2014-3573', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130148.html'}, {'name': 'FEDORA-2014-3526', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-March/130180.html'}, {'name': '[oss-security] 20140306 CVE-2014-0036 rubygem-rbovirt: unsafe use of rest-client', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/509'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1058595'}]
CVE State: PUBLISHED
Explain CVE-2014-0037
The ValidateUserLogon function in provider/libserver/ECSession.cpp in Zarafa 5.00 before 7.1.8 beta2 allows remote attackers to cause a denial of service (crash) via vectors related to "a NULL pointer of the username."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1056767'}, {'name': '[oss-security] 20140131 Security Flaw CVE-2014-0037', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/14'}, {'name': 'MDVSA-2014:044', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:044'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059903'}]
CVE State: PUBLISHED
Explain CVE-2014-0038
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268'}, {'name': 'USN-2096-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2096-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/saelo/cve-2014-0038'}, {'name': 'USN-2095-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2095-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://pastebin.com/raw.php?i=DH3Lbg54'}, {'tags': ['x_refsource_MISC'], 'url': 'https://code.google.com/p/chromium/issues/detail?id=338594'}, {'name': 'USN-2094-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2094-1'}, {'name': 'MDVSA-2014:038', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:038'}, {'name': '56669', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56669'}, {'name': '65255', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65255'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268'}, {'name': '40503', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'https://www.exploit-db.com/exploits/40503/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1060023'}, {'name': 'openSUSE-SU-2014:0204', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html'}, {'name': '31347', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31347'}, {'name': 'openSUSE-SU-2014:0205', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html'}, {'name': '31346', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/31346'}, {'name': '[oss-security] 20140131 Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/01/31/2'}]
CVE State: PUBLISHED
Explain CVE-2014-0039
Untrusted search path vulnerability in fwsnort before 1.6.4, when not running as root, allows local users to execute arbitrary code via a Trojan horse fwsnort.conf in the current working directory.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/mrash/fwsnort/blob/master/ChangeLog'}, {'name': 'FEDORA-2014-1975', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128188.html'}, {'name': 'FEDORA-2014-1972', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128205.html'}, {'name': '102822', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102822'}, {'name': '65341', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65341'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/mrash/fwsnort/commit/fa977453120cc48e1654f373311f9cac468d3348'}, {'name': '[oss-security] 20140203 CVE-2014-0039: fwsnort loaded configuration file from cwd when run as a non-root user', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q1/221'}]
CVE State: PUBLISHED
Explain CVE-2014-0040
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, uses an HTTP connection to download (1) packages and (2) signing keys from Yum repositories, which allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/heat-templates/+bug/1267635'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059514'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3'}, {'name': 'RHSA-2014:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0579.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0041
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets sslverify to false for certain Yum repositories, which disables SSL protection and allows man-in-the-middle attackers to prevent updates via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3CONFIRM:'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/heat-templates/+bug/1267635'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059515'}, {'name': 'RHSA-2014:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0579.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0042
OpenStack Heat Templates (heat-templates), as used in Red Hat Enterprise Linux OpenStack Platform 4.0, sets gpgcheck to 0 for certain templates, which disables GPG signature checking on downloaded packages and allows man-in-the-middle attackers to install arbitrary packages via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/heat-templates/+bug/1267635'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/openstack/heat-templates/commit/65a4f8bebc72da71c616e2e378b7b1ac354db1a3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1059520'}, {'name': 'RHSA-2014:0579', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0579.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0043
In Apache Wicket 1.5.10 or 6.13.0, by issuing requests to special urls handled by Wicket, it is possible to check for the existence of particular classes in the classpath and thus check whether a third party library with a known security vulnerability is in use.
Affected Products: Apache Wicket
References: [{'name': '[wicket-announce] 20140221 CVE-2014-0043', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/d95e962f2f059a09f5abf7086c3f4ed22d2ae2c21499d0de95d4435d%401392986987%40%3Cannounce.wicket.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2014-0044
The opus_packet_get_samples_per_frame function in client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots allows remote attackers to cause a denial of service (crash) via a crafted length prefix value, which triggers a NULL pointer dereference or a heap-based buffer over-read (aka "out-of-bounds array access").
Affected Products: n/a
References: [{'name': 'DSA-2854', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2854'}, {'name': 'openSUSE-SU-2014:0271', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html'}, {'name': '102904', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102904'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-001.txt'}]
CVE State: PUBLISHED
Explain CVE-2014-0045
The needSamples method in AudioOutputSpeech.cpp in the client in Mumble 1.2.4 and the 1.2.3 pre-release snapshots, Mumble for iOS 1.1 through 1.2.2, and MumbleKit before commit fd190328a9b24d37382b269a5674b0c0c7a7e36d does not check the return value of the opus_decode_float function, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Opus voice packet, which triggers an error in opus_decode_float, a conversion of a negative integer to an unsigned integer, and a heap-based buffer over-read and over-write.
Affected Products: n/a
References: [{'name': 'DSA-2854', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2854'}, {'name': '102958', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102958'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-004.txt'}, {'name': '102905', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/102905'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://mumble.info/security/Mumble-SA-2014-002.txt'}, {'name': 'openSUSE-SU-2014:0271', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-02/msg00063.html'}, {'name': '65374', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65374'}]
CVE State: PUBLISHED
Explain CVE-2014-0046
Cross-site scripting (XSS) vulnerability in the link-to helper in Ember.js 1.2.x before 1.2.2, 1.3.x before 1.3.2, and 1.4.x before 1.4.0-beta.6, when used in non-block form, allows remote attackers to inject arbitrary web script or HTML via the title attribute.
Affected Products: n/a
References: [{'name': 'emberjs-linkto-xss(91242)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91242'}, {'name': '56965', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56965'}, {'name': '65579', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65579'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://groups.google.com/forum/#%21topic/ember-security/1h6FRgr8lXQ'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://emberjs.com/blog/2014/02/07/ember-security-releases.html'}, {'name': '[oss-security] 20140214 [CVE-2014-0046] XSS Vulnerability With {{link-to}} Helper in Non-block Form', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/02/14/6'}]
CVE State: PUBLISHED
Explain CVE-2014-0047
Docker before 1.5 allows local users to have unspecified impact via vectors involving unsafe /tmp usage.
Affected Products: n/a
References: [{'name': '73315', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/73315'}, {'name': '[oss-security] 20150324 Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/24/23'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1063549'}]
CVE State: PUBLISHED
Explain CVE-2014-0048
An issue was found in Docker before 1.6.0. Some programs and scripts in Docker are downloaded via HTTP and then executed or used in unsafe ways.
Affected Products: docker.io
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-0048'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0048'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0048'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2014-0048'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/24/23'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/24/18'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2015/03/24/22'}, {'name': '[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2014-0049
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6'}, {'name': '[oss-security] 20140303 CVE-2014-0049 -- Linux kernel: kvm: mmio_fragments out-of-the-bounds access', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/03/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a08d3b3b99efd509133946056531cdf8f3a0c09b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062368'}]
CVE State: PUBLISHED
Explain CVE-2014-0053
The default configuration of the Resources plugin 1.0.0 before 1.2.6 for Pivotal Grails 2.0.0 before 2.3.6 does not properly restrict access to files in the WEB-INF directory, which allows remote attackers to obtain sensitive information via a direct request.  NOTE: this identifier has been SPLIT due to different researchers and different vulnerability types. See CVE-2014-2857 for the META-INF variant and CVE-2014-2858 for the directory traversal.
Affected Products: n/a
References: [{'name': '56841', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/56841'}, {'name': 'grails-cve20140053-info-disc(91270)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/91270'}, {'name': '20140227 Update: CVE-2014-0053 Information Disclosure when using Grails', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://www.securityfocus.com/archive/1/531281/100/0/threaded'}, {'name': '65678', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65678'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.gopivotal.com/security/cve-2014-0053'}, {'tags': ['x_refsource_MISC'], 'url': 'https://twitter.com/Ramsharan065/status/434975409134792704'}, {'name': '20140227 Update: CVE-2014-0053 Information Disclosure when using Grails', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0267.html'}, {'name': '20140219 CVE-2014-0053 Information Disclosure when using Grails', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://archives.neohapsis.com/archives/fulldisclosure/2014-02/0194.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0054
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.
Affected Products: n/a
References: [{'name': '66148', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66148'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://jira.spring.io/browse/SPR-11376'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html'}, {'name': 'RHSA-2014:0400', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0400.html'}, {'name': '57915', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57915'}]
CVE State: PUBLISHED
Explain CVE-2014-0055
The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0328', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0328.html'}, {'name': '59386', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/59386'}, {'name': '66441', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/66441'}, {'name': 'RHSA-2014:0339', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0339.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1062577'}]
CVE State: PUBLISHED
Explain CVE-2014-0056
The l3-agent in OpenStack Neutron 2012.2 before 2013.2.3 does not check the tenant id when creating ports, which allows remote authenticated users to plug ports into the routers of arbitrary tenants via the device id in a port-create command.
Affected Products: n/a
References: [{'name': '[oss-security] 20140328 [OSSA 2014-008] Routers can be cross plugged by other tenants (CVE-2014-0056)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/03/27/5'}, {'name': 'RHSA-2014:0516', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0516.html'}, {'name': 'USN-2194-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2194-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/neutron/+bug/1243327'}]
CVE State: PUBLISHED
Explain CVE-2014-0057
The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0215', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0215.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1064140'}, {'name': '57376', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57376'}]
CVE State: PUBLISHED
Explain CVE-2014-0058
The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0204', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0204.html'}, {'name': 'RHSA-2015:0034', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0034.html'}, {'name': 'RHSA-2014:0205', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0205.html'}, {'name': '65762', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65762'}]
CVE State: PUBLISHED
Explain CVE-2014-0059
JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0565', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0565.html'}, {'name': 'RHSA-2015:0675', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0675.html'}, {'name': 'RHSA-2015:0850', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0850.html'}, {'name': 'RHSA-2014:0563', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0563.html'}, {'name': 'RHSA-2015:0851', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2015-0851.html'}, {'name': 'RHSA-2014:0564', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0564.html'}]
CVE State: PUBLISHED
Explain CVE-2014-0060
PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0211', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0211.html'}, {'name': 'RHSA-2014:0221', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0221.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6448'}, {'name': 'RHSA-2014:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0469.html'}, {'name': 'APPLE-SA-2014-10-16-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.postgresql.org/wiki/20140220securityrelease'}, {'name': 'DSA-2864', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2864'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'name': 'RHSA-2014:0249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0249.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1506/'}, {'name': 'USN-2120-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2120-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6536'}, {'name': 'DSA-2865', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2865'}, {'name': 'openSUSE-SU-2014:0345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': 'openSUSE-SU-2014:0368', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html'}, {'name': '61307', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61307'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://puppet.com/security/cve/cve-2014-0060'}]
CVE State: PUBLISHED
Explain CVE-2014-0061
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0211', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0211.html'}, {'name': 'RHSA-2014:0221', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0221.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6448'}, {'name': 'RHSA-2014:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0469.html'}, {'name': 'APPLE-SA-2014-10-16-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.postgresql.org/wiki/20140220securityrelease'}, {'name': 'DSA-2864', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2864'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'name': 'RHSA-2014:0249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0249.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1506/'}, {'name': 'USN-2120-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2120-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6536'}, {'name': 'DSA-2865', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2865'}, {'name': 'openSUSE-SU-2014:0345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': 'openSUSE-SU-2014:0368', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html'}, {'name': '61307', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61307'}]
CVE State: PUBLISHED
Explain CVE-2014-0062
Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0211', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0211.html'}, {'name': 'RHSA-2014:0221', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0221.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6448'}, {'name': 'RHSA-2014:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0469.html'}, {'name': 'APPLE-SA-2014-10-16-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.postgresql.org/wiki/20140220securityrelease'}, {'name': 'DSA-2864', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2864'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'name': 'RHSA-2014:0249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0249.html'}, {'name': '65727', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65727'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1506/'}, {'name': 'USN-2120-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2120-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6536'}, {'name': 'DSA-2865', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2865'}, {'name': 'openSUSE-SU-2014:0345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': 'openSUSE-SU-2014:0368', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html'}, {'name': '61307', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61307'}]
CVE State: PUBLISHED
Explain CVE-2014-0063
Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
Affected Products: n/a
References: [{'name': 'RHSA-2014:0211', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0211.html'}, {'name': 'RHSA-2014:0221', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0221.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6448'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1065226'}, {'name': 'RHSA-2014:0469', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0469.html'}, {'name': 'APPLE-SA-2014-10-16-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://wiki.postgresql.org/wiki/20140220securityrelease'}, {'name': 'DSA-2864', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2864'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/support/security/'}, {'name': 'RHSA-2014:0249', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0249.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1506/'}, {'name': 'USN-2120-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-2120-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT6536'}, {'name': 'DSA-2865', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2014/dsa-2865'}, {'name': '65719', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/65719'}, {'name': 'openSUSE-SU-2014:0345', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'name': 'openSUSE-SU-2014:0368', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html'}, {'name': '61307', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/61307'}]
CVE State: PUBLISHED