Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-0855
Heap-based buffer overflow in the get_sot function in the J2K decoder (j2k.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) via unspecified vectors related to the curtileno variable.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=3eedf9f716733b3b4c5205726d2c1ca52b3d3d78'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}, {'name': 'ffmpeg-getsot-bo(78929)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78929'}]
CVE State: PUBLISHED
Explain CVE-2012-0856
Heap-based buffer overflow in the MPV_frame_start function in libavcodec/mpegvideo.c in FFmpeg before 0.9.1, when the lowres option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted H263 media file.  NOTE: this vulnerability exists because of a regression error.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/trac/ffmpeg/ticket/757'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=21270cffaeab2f67a613907516b2b0cd6c9eacf4'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'name': 'ffmpeg-mpvframestart-bo(78928)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78928'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0857
Multiple buffer overflows in the get_qcx function in the J2K decoder (j2kdec.c) in libavcode in FFmpeg before 0.9.1 allow remote attackers to cause a denial of service (application crash) via unspecified vectors.
Affected Products: n/a
References: [{'name': 'ffmpeg-getqcx-bo(78927)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78927'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}, {'name': '[oss-security] 20120201 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/01/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0858
The Shorten codec (shorten.c) in libavcodec in FFmpeg 0.7.x before 0.7.12 and 0.8.x before 0.8.11, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Shorten file, related to an "invalid free".
Affected Products: n/a
References: [{'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=204cb29b3c84a74cbcd059d353c70c8bdc567d98'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://libav.org/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.libav.org/?p=libav.git%3Ba=commitdiff%3Bh=204cb29b3c84a74cbcd059d353c70c8bdc567d98'}]
CVE State: PUBLISHED
Explain CVE-2012-0859
The render_line function in the vorbis codec (vorbis.c) in libavcodec in FFmpeg before 0.9.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted Vorbis file, related to a large multiplier.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-3893.
Affected Products: n/a
References: [{'name': 'USN-1479-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1479-1'}, {'name': '[oss-security] 20120214 Re: CVE Requests for FFmpeg 0.9.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/14/4'}, {'name': 'ffmpeg-renderline-code-exec(78925)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78925'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.videolan.org/?p=ffmpeg.git%3Ba=commitdiff%3Bh=6fcf2bb8af0e7d6bb179e71e67e5fab8ef0d2ec2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ffmpeg.org/security.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0860
Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.
Affected Products: n/a
References: [{'name': 'RHSA-2012:1508', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1508.html'}, {'name': '56825', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56825'}, {'name': 'RHSA-2012:1506', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1506.html'}, {'name': 'enterprise-rhev-priv-esc(80543)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80543'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=790730'}, {'name': '1027838', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027838'}]
CVE State: PUBLISHED
Explain CVE-2012-0861
The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.
Affected Products: n/a
References: [{'name': 'RHSA-2012:1508', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1508.html'}, {'name': '56825', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/56825'}, {'name': 'RHSA-2012:1506', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1506.html'}, {'name': 'RHSA-2012:1505', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1505.html'}, {'name': 'enterprise-ssl-certificates-mitm(80544)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/80544'}, {'name': '1027838', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027838'}]
CVE State: PUBLISHED
Explain CVE-2012-0862
builtins.c in Xinetd before 2.3.15 does not check the service type when the tcpmux-server service is enabled, which exposes all enabled services and allows remote attackers to bypass intended access restrictions via a request to tcpmux port 1.
Affected Products: n/a
References: [{'name': '1027050', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027050'}, {'name': '[oss-security] 20120509 CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/05/09/5'}, {'name': 'FEDORA-2012-8041', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081446.html'}, {'name': '81774', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/81774'}, {'name': 'xinetd-tcpmux-weak-security(75965)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/75965'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/attachment.cgi?id=583311'}, {'name': 'RHSA-2013:1302', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1302.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=790940'}, {'name': 'FEDORA-2012-8061', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081428.html'}, {'name': '[oss-security] 20120510 Re: CVE-2012-0862 assignment notification: xinetd enables unintentional services over tcpmux port', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/05/10/2'}, {'name': '53720', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/53720'}, {'name': 'MDVSA-2012:155', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:155'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.xinetd.org/#changes'}]
CVE State: PUBLISHED
Explain CVE-2012-0863
Mumble 1.2.3 and earlier uses world-readable permissions for .local/share/data/Mumble/.mumble.sqlite files in home directories, which might allow local users to obtain a cleartext password and configuration data by reading a file.
Affected Products: n/a
References: [{'name': '52024', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52024'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/mumble/+bug/783405'}, {'name': '[oss-security] 20120215 Re: CVE request: mumble local information disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/15/2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/mumble-voip/mumble/commit/5632c35d6759f5e13a7dfe78e4ee6403ff6a8e3e'}, {'name': 'DSA-2411', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2411'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.gentoo.org/show_bug.cgi?id=403939'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=791000'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=659039'}, {'name': '47951', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47951'}, {'name': '[oss-security] 20120215 CVE request: mumble local information disclosure', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/15/1'}]
CVE State: PUBLISHED
Explain CVE-2012-0864
Integer overflow in the vfprintf function in stdio-common/vfprintf.c in glibc 2.14 and other versions allows context-dependent attackers to bypass the FORTIFY_SOURCE protection mechanism, conduct format string attacks, and write to arbitrary memory via a large number of arguments.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0531', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0531.html'}, {'name': '52201', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52201'}, {'name': 'RHSA-2012:0393', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0393.html'}, {'name': 'RHSA-2012:0397', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0397.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://sourceware.org/git/?p=glibc.git%3Ba=commitdiff%3Bh=7c1f4834d398163d1ac8101e35e9c36fc3176e6e'}, {'name': 'RHSA-2012:0488', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0488.html'}, {'name': '[libc-alpha] 20120202 [PATCH] vfprintf: validate nargs and positional offsets', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://sourceware.org/ml/libc-alpha/2012-02/msg00023.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=794766'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.phrack.org/issues.html?issue=67&id=9#article'}]
CVE State: PUBLISHED
Explain CVE-2012-0865
Multiple open redirect vulnerabilities in CubeCart 3.0.20 and earlier allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) r parameter to switch.php or (2) goto parameter to admin/login.php.
Affected Products: n/a
References: [{'name': '[oss-security] 20120213 Re: CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/13/5'}, {'name': '[oss-security] 20120217 Re: CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/18/1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5Bcubecart_3.0.20_3.0.x%5D_open_url_redirection'}, {'name': '[oss-security] 20120212 CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/12/4'}, {'name': '79140', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79140'}, {'name': '20120210 CubeCart 3.0.20 (3.0.x) and lower | Open URL Redirection Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0058.html'}, {'name': '79141', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79141'}, {'name': '1026711', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026711'}, {'name': '51966', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51966'}]
CVE State: PUBLISHED
Explain CVE-2012-0866
CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1377/'}, {'name': 'MDVSA-2012:027', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:027'}, {'name': '49273', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49273'}, {'name': 'RHSA-2012:0678', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0678.html'}, {'name': 'MDVSA-2012:026', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.0/static/release-9-0-7.html'}, {'name': 'MDVSA-2012:092', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:092'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.4/static/release-8-4-11.html'}, {'name': 'DSA-2418', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2418'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.3/static/release-8-3-18.html'}, {'name': '49272', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.1/static/release-9-1-3.html'}, {'name': 'RHSA-2012:0677', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0677.html'}, {'name': 'openSUSE-SU-2012:1173', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0867
PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1377/'}, {'name': '49273', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49273'}, {'name': 'RHSA-2012:0678', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0678.html'}, {'name': 'MDVSA-2012:026', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.0/static/release-9-0-7.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.4/static/release-8-4-11.html'}, {'name': 'DSA-2418', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2418'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.1/static/release-9-1-3.html'}, {'name': 'openSUSE-SU-2012:1173', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0868
CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/about/news/1377/'}, {'name': 'MDVSA-2012:027', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:027'}, {'name': '49273', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49273'}, {'name': 'RHSA-2012:0678', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0678.html'}, {'name': 'MDVSA-2012:026', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:026'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.0/static/release-9-0-7.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.4/static/release-8-4-11.html'}, {'name': 'DSA-2418', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2418'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/8.3/static/release-8-3-18.html'}, {'name': '49272', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49272'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.postgresql.org/docs/9.1/static/release-9-1-3.html'}, {'name': 'RHSA-2012:0677', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0677.html'}, {'name': 'openSUSE-SU-2012:1173', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0869
Cross-site scripting (XSS) vulnerability in fup in Frams' Fast File EXchange (F*EX, aka fex) before 20120215 allows remote attackers to inject arbitrary web script or HTML via the id parameter.
Affected Products: n/a
References: [{'name': 'DSA-2414', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2414'}, {'name': 'fastfileexchange-fup-id-xss(78966)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/78966'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://fex.rus.uni-stuttgart.de/fex.html'}, {'name': '20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0112.html'}, {'name': '47971', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47971'}, {'name': '[oss-security] 20120223 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/23/2'}, {'name': '[oss-security] 20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/1'}, {'name': '79420', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/79420'}, {'name': '[oss-security] 20120220 Re: Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/8'}, {'name': '52085', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52085'}, {'name': '20120220 Vulnerabilitites in Debian F*EX <= 20100208 and F*EX 20111129-2.', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0109.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0870
Heap-based buffer overflow in process.c in smbd in Samba 3.0, as used in the file-sharing service on the BlackBerry PlayBook tablet before 2.0.0.7971 and other products, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a Batched (aka AndX) request that triggers infinite recursion.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://btsc.webapps.blackberry.com/btsc/search.do?cmd=displayKC&docType=kc&externalId=KB29565'}, {'name': 'SUSE-SU-2012:0337', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00008.html'}, {'name': 'USN-1374-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1374-1'}, {'name': 'SUSE-SU-2012:0515', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00014.html'}, {'name': 'SUSE-SU-2012:0502', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00008.html'}, {'name': '48844', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48844'}, {'name': '48116', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48116'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=795509'}, {'name': '48879', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48879'}, {'name': '48186', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48186'}, {'name': 'SUSE-SU-2012:0338', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00009.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5281'}, {'name': 'APPLE-SA-2012-05-09-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/May/msg00001.html'}, {'name': 'blackberry-playbook-samba-code-execution(73361)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73361'}]
CVE State: PUBLISHED
Explain CVE-2012-0871
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.
Affected Products: n/a
References: [{'name': 'SUSE-SA:2012:001', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-02/msg00030.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/systemd/systemd/commit/?id=fc3c1c6e091ea16ad5600b145201ec535bbb5d7c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=795853'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=747154'}, {'name': '79768', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/79768'}]
CVE State: PUBLISHED
Explain CVE-2012-0872
Multiple cross-site scripting (XSS) vulnerabilities in OxWall 1.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) captchaField, (2) email, (3) form_name, (4) password, (5) realname, (6) repeatPassword, or (7) username parameters to Oxwall/join; (8) captcha, (9) email, (10) form_name, (11) from, or (12) subject parameters to Oxwall/contact; (13) tag parameter to Oxwall/blogs/browse-by-tag; or (14) PATH_INFO to Oxwall/photo/viewlist/tagged, (15) Oxwall/photo/viewlist, or (16) Oxwall/video/viewlist.
Affected Products: n/a
References: [{'name': 'oxwall-multiple-xss(73466)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73466'}, {'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5BOxWall_1.1.1%5D_xss'}, {'name': '[oss-security] 20120221 OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/5'}, {'name': '[oss-security] 20120220 Re: OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/10'}, {'name': '20120220 Re: [oss-security] OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0113.html'}, {'name': '20120220 OxWall 1.1.1 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0106.html'}, {'name': '52090', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52090'}]
CVE State: PUBLISHED
Explain CVE-2012-0873
Multiple cross-site scripting (XSS) vulnerabilities in Boonex Dolphin before 7.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) explain parameter to explanation.php or the (2) photos_only, (3) online_only, or (4) mode parameters to viewFriends.php.
Affected Products: n/a
References: [{'name': '20120220 Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-02/0107.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.boonex.com/n/dolphin-7-0-8-released'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.boonex.com/trac/dolphin/changeset/15282'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.boonex.com/trac/dolphin/changeset/15283'}, {'name': '[oss-security] 20120220 Re: Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/11'}, {'tags': ['x_refsource_MISC'], 'url': 'http://yehg.net/lab/pr0js/advisories/%5BDolphin_7.0.7%5D_xss'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.boonex.com/trac/dolphin/ticket/2530'}, {'name': '52088', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52088'}, {'name': '[oss-security] 20120221 Dolphin 7.0.7 <= Multiple Cross Site Scripting Vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/20/6'}]
CVE State: PUBLISHED
Explain CVE-2012-0874
The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow remote attackers to invoke MBean methods and execute arbitrary code via unspecified vectors.  NOTE: this issue can only be exploited when the interceptor is not properly configured with a "second layer of authentication," or when used in conjunction with other vulnerabilities that bypass this second layer.
Affected Products: n/a
References: [{'name': 'RHSA-2013:0192', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0192.html'}, {'name': 'RHSA-2013:0198', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0198.html'}, {'name': 'RHSA-2013:0195', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0195.html'}, {'name': 'RHSA-2013:0221', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0221.html'}, {'name': 'RHSA-2013:0196', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0196.html'}, {'name': '57552', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/57552'}, {'name': 'RHSA-2013:0193', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0193.html'}, {'name': '51984', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51984'}, {'name': '1028042', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1028042'}, {'name': '52054', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52054'}, {'name': '20131219 ESA-2013-094: EMC Data Protection Advisor JBOSS Remote Code Execution Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-12/0134.html'}, {'name': 'RHSA-2013:0191', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0191.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=795645'}, {'name': 'RHSA-2013:0533', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0533.html'}, {'name': 'RHSA-2013:0197', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0197.html'}, {'name': '30211', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/30211'}, {'name': 'jboss-eap-jmxinvokerhaservlet-code-exec(81511)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/81511'}, {'name': 'RHSA-2013:0194', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0194.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0875
SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0376', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0376.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceware.org/bugzilla/show_bug.cgi?id=13714'}, {'name': '1026777', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1026777'}, {'name': '[oss-security] 20120222 CVE-2012-0875: systemtap memory disclosure/kernel panic when processing malformed DWARF unwind data', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://permalink.gmane.org/gmane.comp.security.oss.general/6987'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceware.org/git/?p=systemtap.git%3Ba=commit%3Bh=64b0cff3b'}, {'name': 'openSUSE-SU-2013:0475', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00057.html'}]
CVE State: PUBLISHED
Explain CVE-2012-0876
The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML file with many identifiers with the same value.
Affected Products: n/a
References: [{'name': '49504', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49504'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/tracker/?func=detail&atid=110127&aid=3496608&group_id=10127'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.tenable.com/security/tns-2016-20'}, {'name': 'USN-1527-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1527-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.python.org/issue13703#msg151870'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/HT205637'}, {'name': '51040', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51040'}, {'name': 'RHSA-2012:0731', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0731.html'}, {'name': '52379', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52379'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://sourceforge.net/projects/expat/files/expat/2.1.0/'}, {'name': 'RHSA-2016:0062', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-0062.html'}, {'name': 'APPLE-SA-2013-10-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'}, {'name': 'APPLE-SA-2015-12-08-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Dec/msg00005.html'}, {'name': 'DSA-2525', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2525'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/bulletinjul2016-3090568.html'}, {'name': 'MDVSA-2012:041', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:041'}, {'name': 'RHSA-2016:2957', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2016-2957.html'}, {'name': 'USN-1613-2', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1613-2'}, {'name': '[Expat-discuss] 20120304 Announcement: Expat 2.1.0 Beta can be tested', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://mail.libexpat.org/pipermail/expat-discuss/2012-March/002768.html'}, {'name': '51024', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51024'}, {'name': 'USN-1613-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1613-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10365'}]
CVE State: PUBLISHED
Explain CVE-2012-0877
PyXML: Hash table collisions CPU usage Denial of Service
Affected Products: PyXML
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-0877'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-0877'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-0877'}, {'tags': ['x_refsource_MISC'], 'url': 'http://seclists.org/oss-sec/2014/q3/96'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2014/07/08/11'}]
CVE State: PUBLISHED
Explain CVE-2012-0878
Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=796790'}, {'name': '[oss-security] 20120223 CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/23/1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bitbucket.org/ianb/pastescript/pull-request/3/fix-group-permissions-for-pastescriptserve'}, {'name': '48812', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48812'}, {'name': '[oss-security] 20120223 Re: CVE Request -- python-paste-script: Supplementary groups not dropped when started an application with "paster serve" as root', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/23/4'}, {'name': 'RHSA-2012:1206', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1206.html'}, {'name': '50410', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50410'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://groups.google.com/group/paste-users/browse_thread/thread/2aa651ba331c2471'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bitbucket.org/ianb/pastescript/changeset/a19e462769b4'}]
CVE State: PUBLISHED
Explain CVE-2012-0879
The I/O implementation for block devices in the Linux kernel before 2.6.33 does not properly handle the CLONE_IO feature, which allows local users to cause a denial of service (I/O instability) by starting multiple processes that share an I/O context.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0531', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0531.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=61cc74fbb87af6aa551a06a370590c9bc07e29d9'}, {'name': 'USN-1408-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1408-1'}, {'name': '[oss-security] 20120223 Re: CVE request -- kernel: block: CLONE_IO io_context refcounting issues', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/23/5'}, {'name': '1027086', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027086'}, {'name': 'DSA-2469', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2469'}, {'name': 'RHSA-2012:0481', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0481.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=796829'}, {'name': 'SUSE-SU-2012:0616', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html'}, {'name': '48545', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48545'}, {'name': 'USN-1411-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1411-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/b69f2292063d2caf37ca9aec7d63ded203701bf3'}, {'name': '48842', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48842'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/61cc74fbb87af6aa551a06a370590c9bc07e29d9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://ftp.osuosl.org/pub/linux/kernel/v2.6/ChangeLog-2.6.33'}, {'name': 'USN-1410-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1410-1'}, {'name': 'HPSBGN02970', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139447903326211&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b69f2292063d2caf37ca9aec7d63ded203701bf3'}]
CVE State: PUBLISHED
Explain CVE-2012-0880
Apache Xerces-C++ allows remote attackers to cause a denial of service (CPU consumption) via a crafted message sent to an XML service that causes hash table collisions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=787103'}, {'name': '[oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://seclists.org/oss-sec/2014/q3/96'}]
CVE State: PUBLISHED
Explain CVE-2012-0881
Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.
Affected Products: n/a
References: [{'name': '[j-users] 20180503 [ANNOUNCEMENT]: Apache Xerces-J 2.12.0 now available', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/49dc6702104a86ecbb40292dcd329ce9ae4c32b74733199ecab14a73%40%3Cj-users.xerces.apache.org%3E'}, {'name': '[oss-security] 20140708 Summer bug cleaning - some Hash DoS stuff', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2014/07/08/11'}, {'name': '[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E'}, {'name': '[drill-dev] 20191017 Dependencies used by Drill contain known vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E'}, {'name': '[drill-dev] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E'}, {'name': '[drill-issues] 20191021 [jira] [Created] (DRILL-7416) Updates required to dependencies to resolve potential security vulnerabilities', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E'}, {'name': '[lucene-solr-user] 20200320 CVEs (vulnerabilities) that apply to Solr 8.4.1', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/r204ba2a9ea750f38d789d2bb429cc0925ad6133deea7cbc3001d96b5%40%3Csolr-user.lucene.apache.org%3E'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/XERCESJ-1685'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=787104'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com//security-alerts/cpujul2021.html'}, {'name': '[hadoop-common-issues] 20210928 [GitHub] [hadoop] warrenzhu25 opened a new pull request #3496: HADOOP-17941. Update xerces to 2.12', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.apache.org/thread.html/rea7b831dceeb2a2fa817be6f63b08722042e3647fb2d47c144370a56%40%3Ccommon-issues.hadoop.apache.org%3E'}]
CVE State: PUBLISHED
Explain CVE-2012-0882
Buffer overflow in yaSSL, as used in MySQL 5.5.20 and possibly other versions including 5.5.x before 5.5.22 and 5.1.x before 5.1.62, allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by VulnDisco Pack Professional 9.17.  NOTE: as of 20120224, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.  NOTE: due to lack of details, it is not clear whether this issue is a duplicate of CVE-2012-0492 or another CVE.
Affected Products: n/a
References: [{'name': '[Canvas] 20120223 VulnDisco MySQL 0day', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.immunityinc.com/pipermail/canvas/2012-February/000014.html'}, {'name': '[Canvas] 20120207 VulnDisco Pack Professional 9.17', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.immunityinc.com/pipermail/canvas/2012-February/000011.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=789141'}, {'name': '[oss-security] 20120224 Re: MySQL 0-day - does it need a CVE?', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/02/24/2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://blogs.oracle.com/sunsecurity/entry/cve_2012_0882buffer_overflow_vulnerability'}]
CVE State: PUBLISHED
Explain CVE-2012-0885
chan_sip.c in Asterisk Open Source 1.8.x before 1.8.8.2 and 10.x before 10.0.1, when the res_srtp module is used and media support is improperly configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted SDP message with a crypto attribute and a (1) video or (2) text media type, as demonstrated by CSipSimple.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-001-10.diff'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.asterisk.org/jira/browse/ASTERISK-19202'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-001-1.8.diff'}, {'name': '[oss-security] 20120120 CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/20/16'}, {'name': '[oss-security] 20120120 Re: CVE Request -- Asterisk AST-2012-001 / Remote DoS while processing crypto line for media stream with non-existing RTP', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/01/20/18'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.asterisk.org/jira/secure/attachment/42202/issueA19202_crypto_if_uninited_text_or_video.patch'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=783487'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-001.html'}]
CVE State: PUBLISHED