Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0817
Memory leak in smbd in Samba 3.6.x before 3.6.3 allows remote attackers to cause a denial of service (memory and CPU consumption) by making many connection requests.
Affected Products: n/a
References: [{'name': '47763', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47763'}, {'name': 'SUSE-SU-2012:0515', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.html'}, {'name': 'SUSE-SU-2012:0502', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/history/samba-3.6.3.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.samba.org/samba/security/CVE-2012-0817'}, {'name': 'FEDORA-2012-1098', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-February/072930.html'}, {'name': '48879', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48879'}]
CVE State: PUBLISHED
Explain CVE-2012-0818
RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=785631'}, {'name': 'RHSA-2012:1059', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1059.html'}, {'name': '51748', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51748'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.jboss.org/browse/RESTEASY-637'}, {'name': 'RHSA-2012:1056', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1056.html'}, {'name': 'RHSA-2012:1058', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1058.html'}, {'name': '51766', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51766'}, {'name': '78679', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78679'}, {'name': 'RHSA-2012:0519', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0519.html'}, {'name': '50084', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50084'}, {'name': 'RHSA-2014:0371', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0371.html'}, {'name': 'RHSA-2012:1057', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1057.html'}, {'name': 'resteasy-xml-info-disclosure(72808)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72808'}, {'name': '48954', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48954'}, {'name': 'RHSA-2012:0441', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0441.html'}, {'name': '47832', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47832'}, {'name': '57719', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57719'}, {'name': '57716', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/57716'}, {'name': '47818', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47818'}, {'name': 'RHSA-2014:0372', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2014-0372.html'}, {'name': '48697', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48697'}, {'name': 'RHSA-2012:1125', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1125.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0819
Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0821.
Affected Products: n/a
References: [{'name': '[oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/4'}, {'name': '[oss-security] 20120125 Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/25/1'}, {'name': '[oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html'}, {'name': '[oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/30/1'}, {'name': '47753', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html'}, {'name': '78517', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78517'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/382-20120101-core-information-disclosure'}]
CVE State: PUBLISHED
Explain CVE-2012-0820
Cross-site scripting (XSS) vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0822.
Affected Products: n/a
References: [{'name': '[oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/4'}, {'name': '78515', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78515'}, {'name': '[oss-security] 20120125 Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/25/1'}, {'name': '[oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html'}, {'name': '[oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/30/1'}, {'name': '47753', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/383-20120102-core-xss-vulnerability'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0821
Unspecified vulnerability in Joomla! 1.6.x and 1.7.x before 1.7.4 allows remote attackers to obtain sensitive information via unknown vectors, a different vulnerability than CVE-2012-0819.
Affected Products: n/a
References: [{'name': '[oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/4'}, {'name': '[oss-security] 20120125 Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/25/1'}, {'name': '[oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/384-20120103-core-information-disclosure'}, {'name': '[oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/30/1'}, {'name': '47753', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47753'}, {'name': '78518', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78518'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0822
Cross-site scripting (XSS) vulnerability in Joomla! 1.6 and 1.7.x before 1.7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2012-0820.
Affected Products: n/a
References: [{'name': '[oss-security] 20120126 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/4'}, {'name': '78516', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78516'}, {'name': '[oss-security] 20120125 Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/25/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/385-20120104-core-xss-vulnerability'}, {'name': '[oss-security] 20120125 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/26/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5405-joomla-174-released.html'}, {'name': '[oss-security] 20120129 Re: Fwd Joomla! Security News 2012-01', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/30/1'}, {'name': '47753', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47753'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5403-joomla-250-released.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0823
VP8 Codec SDK (libvpx) before 1.0.0 "Duclair" allows remote attackers to cause a denial of service (application crash) via (1) unspecified "corrupt input" or (2) by "starting decoding from a P-frame," which triggers an out-of-bounds read, related to "the clamping of motion vectors in SPLITMV blocks".
Affected Products: n/a
References: [{'name': '51775', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51775'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://code.google.com/p/webm/source/browse/CHANGELOG?repo=libvpx'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://blog.webmproject.org/2012/01/vp8-codec-sdk-duclair-released.html'}, {'name': '[oss-security] 20120129 Re: (maybe) CVE request: libvpx before 1.0 crasher', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/30/2'}, {'name': 'MDVSA-2012:023', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:023'}, {'name': '[oss-security] 20120128 (maybe) CVE request: libvpx before 1.0 crasher', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/28/4'}]
CVE State: PUBLISHED
Explain CVE-2012-0824
gnusound 0.7.5 has format string issue
Affected Products: gnusound
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0824'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0824'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/31/3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://people.canonical.com/~ubuntu-security/cve/2012/CVE-2012-0824.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0825
Drupal 6.x before 6.23 and 7.x before 7.11 does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1425084'}, {'tags': ['x_refsource_MISC'], 'url': 'http://openid.net/2011/05/05/attribute-exchange-security-alert/'}, {'name': 'DSA-2776', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2776'}]
CVE State: PUBLISHED
Explain CVE-2012-0826
Cross-site request forgery (CSRF) vulnerability in the Aggregator module in Drupal 6.x before 6.23 and 7.x before 7.11 allows remote attackers to hijack the authentication of unspecified victims for requests that update feeds and possibly cause a denial of service (loss of updates due to rate limit) via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1425084'}, {'name': 'DSA-2776', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2776'}]
CVE State: PUBLISHED
Explain CVE-2012-0827
The File module in Drupal 7.x before 7.11, when using unspecified field access modules, allows remote authenticated users to read arbitrary private files that are associated with restricted fields via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://drupal.org/node/1425084'}]
CVE State: PUBLISHED
Explain CVE-2012-0828
Heap-based buffer overflow in Xchat-WDK before 1499-4 (2012-01-18) xchat 2.8.6 on Maemo architecture could allow remote attackers to cause a denial of service (xchat client crash) or execute arbitrary code via a UTF-8 line from server containing characters outside of the Basic Multilingual Plane (BMP).
Affected Products: Xchat-WDK
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0828'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0828'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0828'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/9'}]
CVE State: PUBLISHED
Explain CVE-2012-0829
Multiple cross-site request forgery (CSRF) vulnerabilities in Mibew Messenger 1.6.4 and earlier allow remote attackers to hijack the authentication of operators for requests that insert cross-site scripting (XSS) sequences via the (1) address or (2) threadid parameters to operator/ban.php; or (3) geolinkparams, (4) title, or (5) chattitle parameters to operator/settings.php.
Affected Products: n/a
References: [{'name': 'mibew-webinterface-csrf(72822)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72822'}, {'name': '47787', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47787'}, {'name': '51723', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51723'}, {'name': '20120130 Mibew messenger multiple XSS', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0178.html'}, {'name': '[oss-security] 20120202 Re: XSS hiding CSRF (was: Re: Mibew messenger multiple XSS)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/02/10'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.codseq.it/advisories/mibew_messenger_multiple_xss'}]
CVE State: PUBLISHED
Explain CVE-2012-0831
PHP before 5.3.10 does not properly perform a temporary change to the magic_quotes_gpc directive during the importing of environment variables, which makes it easier for remote attackers to conduct SQL injection attacks via a crafted request, related to main/php_variables.c, sapi/cgi/cgi_main.c, and sapi/fpm/fpm/fpm_main.c.
Affected Products: n/a
References: [{'name': 'USN-1358-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1358-1'}, {'name': 'SUSE-SU-2012:0411', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00013.html'}, {'name': '55078', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55078'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc?view=revision&revision=323016'}, {'name': 'openSUSE-SU-2012:0426', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html'}, {'name': 'SUSE-SU-2012:0472', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00001.html'}, {'name': '48668', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48668'}, {'name': 'APPLE-SA-2012-09-19-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html'}, {'name': 'RHSA-2013:1307', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1307.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5501'}, {'name': 'FEDORA-2012-6907', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://launchpadlibrarian.net/92454212/php5_5.3.2-1ubuntu4.13.diff.gz'}, {'name': 'php-magicquotesgpc-sec-bypass(73125)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73125'}, {'name': '51954', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51954'}, {'name': 'FEDORA-2012-6911', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0833
The acllas__handle_group_entry function in servers/plugins/acl/acllas.c in 389 Directory Server before 1.2.10 does not properly handled access control instructions (ACIs) that use certificate groups, which allows remote authenticated LDAP users with a certificate group to cause a denial of service (infinite loop and CPU consumption) by binding to the server.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0813', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0813.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/389/ticket/162'}, {'name': '49562', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49562'}, {'name': '48035', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48035'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://fedorahosted.org/389/changeset/1bbbb3e5049c1aa0650546efab87ed2f1ea59637/389-ds-base'}]
CVE State: PUBLISHED
Explain CVE-2012-0834
Cross-site scripting (XSS) vulnerability in lib/QueryRender.php in phpLDAPadmin 1.2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the base parameter in a query_engine action to cmd.php.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://phpldapadmin.git.sourceforge.net/git/gitweb.cgi?p=phpldapadmin/phpldapadmin%3Ba=commit%3Bh=7dc8d57d6952fe681cb9e8818df7f103220457bd'}, {'name': '47852', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47852'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://sourceforge.net/tracker/index.php?func=detail&aid=3477910&group_id=61828&atid=498546'}, {'name': '[oss-security] 20120203 Re: CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/03/3'}, {'name': '[oss-security] 20120202 CVE request: phpldapadmin "base" Cross-Site Scripting Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/02/9'}, {'name': 'MDVSA-2012:020', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:020'}]
CVE State: PUBLISHED
Explain CVE-2012-0835
Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain sensitive information via unknown vectors related to "administrator."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html'}, {'name': '[oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/387-20120201-core-information-disclosure'}, {'name': '47847', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47847'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html'}, {'name': '[oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/6'}, {'name': '78824', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78824'}]
CVE State: PUBLISHED
Explain CVE-2012-0836
Unspecified vulnerability in Joomla! 1.7.x before 1.7.5 allows attackers to read the error log via unknown vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html'}, {'name': '[oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/9'}, {'name': '47847', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47847'}, {'name': '[oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/6'}, {'name': '78825', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78825'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/388-20120201-core-information-disclosure'}]
CVE State: PUBLISHED
Explain CVE-2012-0837
Joomla! 1.7.x before 1.7.5 and 2.5.x before 2.5.1 allows attackers to obtain the installation path via unspecified vectors related to "administrator."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5411-joomla-175-released.html'}, {'name': '[oss-security] 20120203 Re: CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/9'}, {'name': '47847', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47847'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.joomla.org/announcements/release-news/5410-joomla-251-released.html'}, {'name': '[oss-security] 20120203 CVE-request: Joomla! Security News 2012-02-03', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/03/6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.joomla.org/security/news/389-20120201-core-information-disclosure'}, {'name': '78826', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78826'}]
CVE State: PUBLISHED
Explain CVE-2012-0838
Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
Affected Products: n/a
References: [{'name': 'JVNDB-2012-000012', 'tags': ['third-party-advisory', 'x_refsource_JVNDB'], 'url': 'http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://struts.apache.org/2.3.1.2/docs/s2-007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/WW-3668'}, {'name': 'JVN#79099262', 'tags': ['third-party-advisory', 'x_refsource_JVN'], 'url': 'http://jvn.jp/en/jp/JVN79099262/index.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0839
OCaml 3.12.1 and earlier computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://www.nruns.com/_downloads/advisory28122011.pdf'}, {'name': '[caml-list] 20111230 Hashtbl and security', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/caml-list%40inria.fr/msg01477.html'}, {'name': '47853', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47853'}, {'name': '[caml-list] 20111230 Re: Hashtbl and security', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/caml-list%40inria.fr/msg01478.html'}, {'name': '[oss-security] 20120206 Re: CVE request: Hash DoS vulnerability (ocert-2011-003)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/07/2'}, {'name': '[oss-security] 20120206 CVE request: Hash DoS vulnerability (ocert-2011-003)', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/07/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.ocert.org/advisories/ocert-2011-003.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0840
tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table.
Affected Products: n/a
References: [{'name': '[apr-commits] 20120115 svn commit: r1231605 - /apr/apr/trunk/tables/apr_hash.c', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail-archives.apache.org/mod_mbox/apr-commits/201201.mbox/%3C20120115003715.071D423888FD%40eris.apache.org%3E'}, {'name': 'apacheapr-hash-dos(73096)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73096'}, {'name': '[oss-security] 20120208 CVE request: apr - Hash DoS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/08/3'}, {'name': 'MDVSA-2012:019', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:019'}, {'name': '47862', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47862'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.apache.org/viewvc?rev=1231605&view=rev'}, {'name': '[dev] 20120105 Hash collision vectors in APR?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/dev%40apr.apache.org/msg24439.html'}, {'name': '[dev] 20120113 Re: Hash collision vectors in APR?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/dev%40apr.apache.org/msg24472.html'}, {'name': '[oss-security] 20120208 Re: CVE request: apr - Hash DoS vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/02/09/1'}, {'name': '[dev] 20120114 Re: Hash collision vectors in APR?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.mail-archive.com/dev%40apr.apache.org/msg24473.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0841
libxml2 before 2.8.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data.
Affected Products: n/a
References: [{'name': 'APPLE-SA-2013-10-22-8', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html'}, {'name': 'SUSE-SU-2013:1627', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00002.html'}, {'name': 'RHSA-2012:0324', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0324.html'}, {'name': '[oss-security] 20120222 libxml2: hash table collisions CPU usage DoS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/22/1'}, {'name': 'RHSA-2013:0217', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0217.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT6001'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://xmlsoft.org/news.html'}, {'name': '1026723', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1026723'}, {'name': '54886', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/54886'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5934'}, {'name': 'DSA-2417', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2417'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=660846'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://blogs.oracle.com/sunsecurity/entry/cve_2012_0841_denial_of'}, {'name': '55568', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/55568'}, {'name': '52107', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52107'}, {'name': 'MDVSA-2013:150', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:150'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/libxml2/commit/?id=8973d58b7498fa5100a876815476b81fd1a2412a'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf'}, {'name': 'APPLE-SA-2013-09-18-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0842
surf: cookie jar has read access from other local user
Affected Products: surf
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0842'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0842'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0842'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/10/8'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/11/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/10/2'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/10/9'}]
CVE State: PUBLISHED
Explain CVE-2012-0843
uzbl: Information disclosure via world-readable cookies storage file
Affected Products: uzbl
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0843'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0843'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0843'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/11/3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.securityfocus.com/bid/52268'}]
CVE State: PUBLISHED
Explain CVE-2012-0844
Information-disclosure vulnerability in Netsurf through 2.8 due to a world-readable cookie jar.
Affected Products: netsurf
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0844'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0844'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/11/3'}, {'name': '51981', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'https://www.securityfocus.com/bid/51981'}]
CVE State: PUBLISHED
Explain CVE-2012-0845
SimpleXMLRPCServer.py in SimpleXMLRPCServer in Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an XML-RPC POST request that contains a smaller amount of data than specified by the Content-Length header.
Affected Products: n/a
References: [{'name': '[oss-security] 20120213 Re: CVE Request -- python (SimpleXMLRPCServer): DoS (excessive CPU usage) via malformed XML-RPC / HTTP POST request', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/13/4'}, {'name': 'USN-1615-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1615-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://python.org/download/releases/3.2.3/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.python.org/issue14001'}, {'name': '51087', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51087'}, {'name': 'USN-1592-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1592-1'}, {'name': '1026689', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026689'}, {'name': 'USN-1616-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1616-1'}, {'name': '51040', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51040'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=789790'}, {'name': 'APPLE-SA-2013-10-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'}, {'name': '50858', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50858'}, {'name': '51089', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51089'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://python.org/download/releases/2.6.8/'}, {'name': 'USN-1596-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1596-1'}, {'name': 'USN-1613-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1613-2'}, {'name': '51024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51024'}, {'name': 'USN-1613-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1613-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://python.org/download/releases/3.1.5/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://python.org/download/releases/2.7.3/'}, {'name': 'openSUSE-SU-2020:0086', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00040.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0846
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the Location variable.
Affected Products: n/a
References: [{'name': '[oss-security] 20120211 Re: CVE-request: Webcalendar 1.2.4 location XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/12/1'}, {'name': 'webcalendar-location-xss(72563)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72563'}, {'name': '[oss-security] 20120213 Re: CVE-request: Webcalendar 1.2.4 location XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/13/6'}, {'name': '[oss-security] 20120211 CVE-request: Webcalendar 1.2.4 location XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/11/2'}, {'name': '[oss-security] 20120212 Re: CVE-request: Webcalendar 1.2.4 location XSS', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/12/3'}, {'name': "20120119 Webcalendar 1.2.4 'location' XSS", 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0129.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/tracker/?func=detail&aid=3488543&group_id=3870&atid=303870'}, {'name': '51600', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51600'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/tracker/?func=detail&aid=3472745&group_id=3870&atid=103870'}]
CVE State: PUBLISHED
Explain CVE-2012-0847
Heap-based buffer overflow in the avfilter_filter_samples function in libavfilter/avfilter.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file.
Affected Products: n/a
References: [{'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=ae21776207e8a2bbe268e7c9e203f7599dd87ddb'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0848
Heap-based buffer overflow in the ws_snd_decode_frame function in libavcodec/ws-snd1.c in FFmpeg 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted media file, related to an incorrect calculation, aka "wrong samples count."
Affected Products: n/a
References: [{'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=5257743aee0c3982f0079e6553aabc6aa39401d2'}, {'name': 'ffmpeg-wssnddecodeframe-bo(78936)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78936'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0849
Integer overflow in the ff_j2k_dwt_init function in libavcodec/j2k_dwt.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted JPEG2000 image that triggers an incorrect check for a negative value.
Affected Products: n/a
References: [{'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'name': 'ffmpeg-ffj2kdwtinit-dos(78935)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78935'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=1f99939a6361e2e6d6788494dd7c682b051c6c34'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.ffmpeg.org/trac/ffmpeg/ticket/776'}]
CVE State: PUBLISHED
Explain CVE-2012-0850
The sbr_qmf_synthesis function in libavcodec/aacsbr.c in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via a crafted mpg file that triggers memory corruption involving the v_off variable, probably a buffer underflow.
Affected Products: n/a
References: [{'name': 'ffmpeg-sbrqmfsynthesis-dos(78934)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78934'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=944f5b2779e4aa63f7624df6cd4de832a53db81b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0851
The ff_h264_decode_seq_parameter_set function in h264_ps.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted H.264 file, related to the chroma_format_idc value.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/trac/ffmpeg/ticket/758'}, {'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'name': 'DSA-2494', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2494'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libav.org/'}, {'name': 'MDVSA-2013:079', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:079'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=7fff64e00d886fde11d61958888c82b461cf99b9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': 'ffmpeg-ffh264decode-code-exec(78933)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78933'}]
CVE State: PUBLISHED
Explain CVE-2012-0852
The adpcm_decode_frame function in adpcm.c in libavcodec in FFmpeg before 0.9.1 and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.6, and 0.8.x before 0.8.3 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via an ADPCM file with the number of channels not equal to two.
Affected Products: n/a
References: [{'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://ffmpeg.org/trac/ffmpeg/ticket/794'}, {'name': 'DSA-2494', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2494'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=608708009f69ba4cecebf05120c696167494c897'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libav.org/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': 'ffmpeg-adpcmdecodeframe-code-exec(78932)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78932'}]
CVE State: PUBLISHED
Explain CVE-2012-0853
The decodeTonalComponents function in the Actrac3 codec (atrac3.c) in libavcodec in FFmpeg 0.7.x before 0.7.12, and 0.8.x before 0.8.11; and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 allows remote attackers to cause a denial of service (infinite loop and crash) and possibly execute arbitrary code via a large component count in an Atrac 3 file.
Affected Products: n/a
References: [{'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/trac/ffmpeg/ticket/780'}, {'name': '49089', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49089'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=c509f4f74713b035a06f79cb4d00e708f5226bc5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=9af6abdc17deb95c9b1f1d9242ba49b8b5e0b016'}]
CVE State: PUBLISHED
Explain CVE-2012-0854
The dpcm_decode_frame function in libavcodec/dpcm.c in FFmpeg before 0.9.1 does not use the proper pointer after an audio API change, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=6d8e6fe9dbc365f50521cf0c4a5ffee97c970cb5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED