Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2012-1152
Multiple format string vulnerabilities in the error reporting functionality in the YAML::LibYAML (aka YAML-LibYAML and perl-YAML-LibYAML) module 0.38 for Perl allow remote attackers to cause a denial of service (process crash) via format string specifiers in a (1) YAML stream to the Load function, (2) YAML node to the load_node function, (3) YAML mapping to the load_mapping function, or (4) YAML sequence to the load_sequence function.
Affected Products: n/a
References: [{'name': '[oss-security] 20120309 Re: CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/10/4'}, {'name': 'openSUSE-SU-2012:1000', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-08/msg00029.html'}, {'name': 'FEDORA-2012-4997', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077004.html'}, {'name': '48317', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48317'}, {'name': 'FEDORA-2012-5035', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077023.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=661548'}, {'name': 'openSUSE-SU-2015:0319', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2015-02/msg00078.html'}, {'name': '52381', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52381'}, {'name': 'yaml-load-format-string(73856)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/73856'}, {'name': '50277', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50277'}, {'name': '[oss-security] 20120309 CVE Request -- libdbd-pg-perl / perl-DBD-Pg && libyaml-libyaml-perl / perl-YAML-LibYAML: Multiple format string flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/09/6'}, {'name': 'FEDORA-2012-4871', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077782.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://rt.cpan.org/Public/Bug/Display.html?id=75365'}, {'tags': ['x_refsource_MISC'], 'url': 'https://rt.cpan.org/Public/Bug/Display.html?id=46507'}, {'name': 'DSA-2432', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2432'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=801738'}]
CVE State: PUBLISHED
Explain CVE-2012-1153
Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads directory.
Affected Products: n/a
References: [{'name': '78473', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/78473'}, {'name': '[oss-security] 20120309 CVE-request: appRain CMF uploadify.php File Upload Remote PHP Code Execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/09/5'}, {'name': 'appraincmf-uploadify-file-upload(72466)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/72466'}, {'name': '51576', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51576'}, {'name': '20120119 appRain CMF <= 0.1.5 (uploadify.php) Unrestricted File Upload Vulnerability', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-01/0128.html'}, {'name': '18392', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18392'}, {'name': '18922', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/18922'}, {'name': '[oss-security] 20120309 Re: CVE-request: appRain CMF uploadify.php File Upload Remote PHP Code Execution', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/10/5'}]
CVE State: PUBLISHED
Explain CVE-2012-1154
mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used in JBoss Enterprise Application Platform 5.1.2, when "ROOT" is set to excludedContexts, exposes the root context of the server, which allows remote attackers to bypass access restrictions and gain access to applications deployed on the root context via unspecified vectors.
Affected Products: n/a
References: [{'name': 'RHSA-2012:1012', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1012.html'}, {'name': 'RHSA-2012:1166', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1166.html'}, {'name': 'RHSA-2012:1052', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1052.html'}, {'name': 'RHSA-2012:1053', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1053.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.jboss.org/browse/MODCLUSTER-253'}, {'name': '49636', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49636'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=802200'}, {'name': 'RHSA-2012:1010', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1010.html'}, {'name': 'RHSA-2012:1011', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1011.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://community.jboss.org/message/624018'}]
CVE State: PUBLISHED
Explain CVE-2012-1155
Moodle has a database activity export permission issue where the export function of the database activity module exports all entries even those from groups the user does not belong to
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1155'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1155'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1155'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198621'}]
CVE State: PUBLISHED
Explain CVE-2012-1156
Moodle before 2.2.2 has users' private files included in course backups
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1156'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1156'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1156'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198623'}]
CVE State: PUBLISHED
Explain CVE-2012-1157
Moodle before 2.2.2 has a default repository capabilities issue where all repositories are viewable by all users by default
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1157'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1157'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1157'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198624'}]
CVE State: PUBLISHED
Explain CVE-2012-1158
Moodle before 2.2.2 has a course information leak in gradebook where users are able to see hidden grade items in export
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1158'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1158'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1158'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198627'}]
CVE State: PUBLISHED
Explain CVE-2012-1159
Moodle before 2.2.2: Overview report allows users to see hidden courses
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1159'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1159'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1159'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198628'}]
CVE State: PUBLISHED
Explain CVE-2012-1160
Moodle before 2.2.2 has a permission issue in Forum Subscriptions where unenrolled users can subscribe/unsubscribe via mod/forum/index.php
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1160'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1160'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1160'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198629'}]
CVE State: PUBLISHED
Explain CVE-2012-1161
Moodle before 2.2.2: Course information leak via hidden courses being displayed in tag search results
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1161'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1161'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1161'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198630'}]
CVE State: PUBLISHED
Explain CVE-2012-1162
Heap-based buffer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a zip archive with the number of directories set to 0, related to an "incorrect loop construct."
Affected Products: n/a
References: [{'name': '[libzip-discuss] 20120320 libzip-0.10.1 security fix release', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://nih.at/listarchive/libzip-discuss/msg00252.html'}, {'name': '[oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric  overflow in libzip', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/21/2'}, {'name': 'MDVSA-2012:034', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:034'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nih.at/libzip/NEWS.html'}, {'name': '[oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric  overflow in libzip', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/29/11'}, {'name': 'GLSA-201203-23', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-201203-23.xml'}]
CVE State: PUBLISHED
Explain CVE-2012-1163
Integer overflow in the _zip_readcdir function in zip_open.c in libzip 0.10 allows remote attackers to execute arbitrary code via the size and offset values for the central directory in a zip archive, which triggers "improper restrictions of operations within the bounds of a memory buffer" and an information leak.
Affected Products: n/a
References: [{'name': '[libzip-discuss] 20120320 libzip-0.10.1 security fix release', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://nih.at/listarchive/libzip-discuss/msg00252.html'}, {'name': '[oss-security] 20120321 CVE-2012-1162 / -1163: Incorrect loop construct and numeric  overflow in libzip', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/21/2'}, {'name': 'MDVSA-2012:034', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:034'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.nih.at/libzip/NEWS.html'}, {'name': '[oss-security] 20120329 Re: CVE-2012-1162 / -1163: Incorrect loop construct and numeric  overflow in libzip', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/29/11'}, {'name': 'GLSA-201203-23', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://www.gentoo.org/security/en/glsa/glsa-201203-23.xml'}]
CVE State: PUBLISHED
Explain CVE-2012-1164
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned.
Affected Products: n/a
References: [{'name': 'GLSA-201406-36', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'http://security.gentoo.org/glsa/glsa-201406-36.xml'}, {'name': '49607', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49607'}, {'name': '48372', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48372'}, {'name': 'MDVSA-2012:130', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:130'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openldap.org/its/index.cgi/Software%20Bugs?id=7143'}, {'name': 'RHSA-2012:0899', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0899.html'}, {'name': '52404', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52404'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openldap.org/software/release/changes.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT210788'}, {'name': '20191211 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'https://seclists.org/bugtraq/2019/Dec/23'}, {'name': '20191213 APPLE-SA-2019-12-10-3 macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2019/Dec/26'}]
CVE State: PUBLISHED
Explain CVE-2012-1166
The default keybindings for wwm in LTSP Display Manager (ldm) 2.2.x before 2.2.7 allow remote attackers to execute arbitrary commands via the KP_RETURN keybinding, which launches a terminal window.
Affected Products: n/a
References: [{'name': 'USN-1398-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1398-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://irclogs.ltsp.org/?d=2012-03-12'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.launchpad.net/ubuntu/%2Bsource/ldm/%2Bbug/953340'}]
CVE State: PUBLISHED
Explain CVE-2012-1167
The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=802622'}, {'name': 'RHSA-2012:1028', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1028.html'}, {'name': '49658', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49658'}, {'name': '49635', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49635'}, {'name': 'RHSA-2012:1027', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1027.html'}, {'name': 'RHSA-2012:1013', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1013.html'}, {'name': 'jboss-jacc-security-bypass(76680)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/76680'}, {'name': 'RHSA-2012:1026', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1026.html'}, {'name': '50549', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50549'}, {'name': 'RHSA-2012:1014', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1014.html'}, {'name': '54089', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/54089'}, {'name': '1027501', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1027501'}, {'name': 'RHSA-2012:1232', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1232.html'}, {'name': 'RHSA-2012:1125', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1125.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1168
Moodle before 2.2.2 has a password and web services issue where when the user profile is updated the user password is reset if not specified.
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1168'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1168'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1168'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198622'}]
CVE State: PUBLISHED
Explain CVE-2012-1169
Moodle before 2.2.2 has Personal information disclosure, when administrative setting users name display is set to first name only full names are shown in page breadcrumbs.
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1169'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1169'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1169'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198625'}]
CVE State: PUBLISHED
Explain CVE-2012-1170
Moodle before 2.2.2 has an external enrolment plugin context check issue where capability checks are not thorough
Affected Products: Moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078209.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/081047.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078210.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2012-1170'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1170'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2012-1170'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077635.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080712.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=198632'}]
CVE State: PUBLISHED
Explain CVE-2012-1171
The libxml RSHUTDOWN function in PHP 5.x allows remote attackers to bypass the open_basedir protection mechanism and read arbitrary files via vectors involving a stream_close method call during use of a custom stream wrapper.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=802591'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-write.phpt'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.php.net/bug.php?id=61367'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/php/php-src/blob/master/ext/libxml/tests/bug61367-read.phpt'}]
CVE State: PUBLISHED
Explain CVE-2012-1172
The file-upload implementation in rfc1867.c in PHP before 5.4.0 does not properly handle invalid [ (open square bracket) characters in name values, which makes it easier for remote attackers to cause a denial of service (malformed $_FILES indexes) or conduct directory traversal attacks during multi-file uploads by leveraging a script that lacks its own filename restrictions.
Affected Products: n/a
References: [{'name': 'SSRT100856', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=134012830914727&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc/php/php-src/branches/PHP_5_4/main/rfc1867.c?r1=321664&r2=321663&pathrev=321664'}, {'name': 'FEDORA-2012-6869', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080070.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=54374'}, {'name': 'SUSE-SU-2012:0604', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00011.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.php.net/bug.php?id=49683'}, {'tags': ['x_refsource_MISC'], 'url': 'https://nealpoole.com/blog/2011/10/directory-traversal-via-php-multi-file-uploads/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://svn.php.net/viewvc?view=revision&revision=321664'}, {'name': '[oss-security] 20120313 Re: CVE request for PHP 5.3.x Corrupted $_FILES indices lead to security concern', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://openwall.com/lists/oss-security/2012/03/13/4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.php.net/bug.php?id=48597'}, {'name': 'SUSE-SU-2012:0598', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-05/msg00007.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://isisblogs.poly.edu/2011/08/11/php-not-properly-checking-params/'}, {'name': 'APPLE-SA-2012-09-19-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2012/Sep/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5501'}, {'tags': ['x_refsource_MISC'], 'url': 'https://students.mimuw.edu.pl/~ai292615/php_multipleupload_overwrite.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.php.net/ChangeLog-5.php#5.4.0'}, {'name': 'FEDORA-2012-6907', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080041.html'}, {'name': 'HPSBUX02791', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=134012830914727&w=2'}, {'name': 'DSA-2465', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2465'}, {'name': 'FEDORA-2012-6911', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-May/080037.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugs.php.net/bug.php?id=55500'}]
CVE State: PUBLISHED
Explain CVE-2012-1174
The rm_rf_children function in util.c in the systemd-logind login manager in systemd before 44, when logging out, allows local users to delete arbitrary files via a symlink attack on unspecified files, related to "particular records related with user session."
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/systemd/systemd/commit/?id=5ebff5337594d690b322078c512eb222d34aaa82'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=803358'}, {'name': 'FEDORA-2012-6456', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-April/079075.html'}, {'name': '[oss-security] 20120316 [Notification] CVE-2012-1174 systemd: TOCTOU race condition by removing  user session', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/21'}, {'name': 'MDVSA-2012:030', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:030'}]
CVE State: PUBLISHED
Explain CVE-2012-1175
Integer overflow in the GnashImage::size method in libbase/GnashImage.h in GNU Gnash 0.8.10 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SWF file, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '[oss-security] 20120314 CVE request: gnash integer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.savannah.gnu.org/cgit/gnash.git/commit/?id=bb4dc77eecb6ed1b967e3ecbce3dac6c5e6f1527'}, {'name': '47183', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47183'}, {'name': '52446', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52446'}, {'name': 'DSA-2435', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2435'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=803443'}, {'name': '[oss-security] 20120314 Re: CVE request: gnash integer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/6'}, {'name': '48466', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48466'}]
CVE State: PUBLISHED
Explain CVE-2012-1176
Buffer overflow in the fribidi_utf8_to_unicode function in PyFriBidi before 0.11.0 allows remote attackers to cause a denial of service (application crash) via a 4-byte utf-8 sequence.
Affected Products: n/a
References: [{'name': '[oss-security] 20120314 Re: CVE request: pyfribidi buffer overflow flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/9'}, {'name': 'fribidi-utf8-bo(74001)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74001'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pediapress/pyfribidi/commit/d2860c655357975e7b32d84e6b45e98f0dcecd7a'}, {'tags': ['x_refsource_MISC'], 'url': 'http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/aacd036037217998/8d095f85f3665bff?lnk=raot'}, {'name': 'FEDORA-2012-3537', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076038.html'}, {'name': '[oss-security] 20120314 CVE request: pyfribidi buffer overflow flaw', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/4'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=663189'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=801896'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.wikimedia.org/show_bug.cgi?id=35055'}, {'name': '52451', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52451'}, {'name': 'FEDORA-2012-3513', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075293.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/pediapress/pyfribidi/issues/2%29:'}, {'name': 'FEDORA-2012-3549', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-March/076053.html'}]
CVE State: PUBLISHED
Explain CVE-2012-1177
libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/libgdata/commit/?h=libgdata-0-10&id=8eff8fa9138859e03e58c2aa76600ab63eb5c29c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=752088'}, {'name': '[oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/8'}, {'name': '[oss-security] 20120314 CVE Request: libgdata did not verify SSL certificates', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/1'}, {'name': 'DSA-2482', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2482'}, {'name': 'MDVSA-2012:111', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:111'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/libgdata/+bug/938812'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=671535'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.gnome.org/browse/libgdata/commit/?id=6799f2c525a584dc998821a6ce897e463dad7840'}, {'name': '[oss-security] 20120314 Re: CVE Request: libgdata did not verify SSL certificates', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/14/3'}, {'name': '50432', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50432'}, {'name': 'USN-1547-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1547-1'}]
CVE State: PUBLISHED
Explain CVE-2012-1178
The msn_oim_report_to_user function in oim.c in the MSN protocol plugin in libpurple in Pidgin before 2.10.2 allows remote servers to cause a denial of service (application crash) via an OIM message that lacks UTF-8 encoding.
Affected Products: n/a
References: [{'name': 'oval:org.mitre.oval:def:18019', 'tags': ['vdb-entry', 'signature', 'x_refsource_OVAL'], 'url': 'https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18019'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.pidgin.im/ticket/14884'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://pidgin.im/news/security/?id=61'}, {'name': 'MDVSA-2012:029', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2012:029'}, {'name': '52475', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52475'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.pidgin.im/viewmtn/revision/info/3053d6a37cc6d8774aba7607b992a4408216adcd'}, {'name': '50005', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/50005'}, {'name': 'RHSA-2012:1102', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-1102.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://developer.pidgin.im/viewmtn/revision/diff/60f8379d0a610538cf42e0dd9ab1436c8b9308cd/with/3053d6a37cc6d8774aba7607b992a4408216adcd/libpurple/protocols/msn/oim.c'}]
CVE State: PUBLISHED
Explain CVE-2012-1179
The Linux kernel before 3.3.1, when KVM is used, allows guest OS users to cause a denial of service (host OS crash) by leveraging administrative access to the guest OS, related to the pmd_none_or_clear_bad function and page faults for huge pages.
Affected Products: n/a
References: [{'name': 'RHSA-2012:0743', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2012-0743.html'}, {'name': 'SUSE-SU-2012:0554', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00021.html'}, {'name': '1027084', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1027084'}, {'name': '48898', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48898'}, {'name': '[oss-security] 20120315 CVE-2012-1179 kernel: thp: __split_huge_page() mapcount != page_mapcount BUG_ON()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/15/7'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/4a1d704194a441bf83c636004a479e01360ec850'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=803793'}, {'name': '48404', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48404'}, {'name': 'FEDORA-2012-3712', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075781.html'}, {'name': 'HPSBGN02970', 'tags': ['vendor-advisory', 'x_refsource_HP'], 'url': 'http://marc.info/?l=bugtraq&m=139447903326211&w=2'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.1'}]
CVE State: PUBLISHED
Explain CVE-2012-1181
fcgid_spawn_ctl.c in the mod_fcgid module 2.3.6 for the Apache HTTP Server does not recognize the FcgidMaxProcessesPerClass directive for a virtual host, which makes it easier for remote attackers to cause a denial of service (memory consumption) via a series of HTTP requests that triggers a process count higher than the intended limit.
Affected Products: n/a
References: [{'name': "[oss-security] 20120315 Re: CVE-request: apache's mod-fcgid does not respect configured FcgidMaxProcessesPerClass in VirtualHost", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/2'}, {'name': 'apache-modfcgid-dos(74181)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74181'}, {'name': 'DSA-2436', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2436'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615814'}, {'name': '52565', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52565'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/bugzilla/show_bug.cgi?id=49902'}, {'name': "[oss-security] 20120315 CVE-request: apache's mod-fcgid does not respect configured FcgidMaxProcessesPerClass in VirtualHost", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/15/10'}]
CVE State: PUBLISHED
Explain CVE-2012-1183
Stack-based buffer overflow in the milliwatt_generate function in the Miliwatt application in Asterisk 1.4.x before 1.4.44, 1.6.x before 1.6.2.23, 1.8.x before 1.8.10.1, and 10.x before 10.2.1, when the o option is used and the internal_timing option is off, allows remote attackers to cause a denial of service (application crash) via a large number of samples in an audio packet.
Affected Products: n/a
References: [{'name': 'DSA-2460', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2460'}, {'name': '[oss-security] 20120316 Re: CVE Request -- Asterisk: AST-2012-002 and AST-2012-003  flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/17'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-002.pdf'}, {'name': '20120315 AST-2012-002: Remote Crash Vulnerability in Milliwatt Application', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2012-03/0069.html'}, {'name': '80125', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80125'}, {'name': '52523', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/52523'}, {'name': '48941', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48941'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.asterisk.org/node/51797'}, {'name': '48417', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48417'}, {'name': 'asterisk-milliwattgenerate-dos(74082)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74082'}, {'name': '[oss-security] 20120316 CVE Request -- Asterisk: AST-2012-002 and AST-2012-003  flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-002-1.8.diff'}, {'name': '1026812', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://securitytracker.com/id?1026812'}]
CVE State: PUBLISHED
Explain CVE-2012-1184
Stack-based buffer overflow in the ast_parse_digest function in main/utils.c in Asterisk 1.8.x before 1.8.10.1 and 10.x before 10.2.1 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long string in an HTTP Digest Authentication header.
Affected Products: n/a
References: [{'name': '[oss-security] 20120316 Re: CVE Request -- Asterisk: AST-2012-002 and AST-2012-003  flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/17'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-003.pdf'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.asterisk.org/node/51797'}, {'name': '48417', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48417'}, {'name': '[oss-security] 20120316 CVE Request -- Asterisk: AST-2012-002 and AST-2012-003  flaws', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/16/10'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://downloads.asterisk.org/pub/security/AST-2012-003-1.8.diff'}, {'name': '80126', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/80126'}, {'name': '1026813', 'tags': ['vdb-entry', 'x_refsource_SECTRACK'], 'url': 'http://www.securitytracker.com/id?1026813'}, {'name': 'asterisk-astparsedigest-bo(74083)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/74083'}]
CVE State: PUBLISHED
Explain CVE-2012-1185
Multiple integer overflows in (1) magick/profile.c or (2) magick/property.c in ImageMagick 6.7.5 and earlier allow remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset value in the ResolutionUnit tag in the EXIF IFD0 of an image.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0247.
Affected Products: n/a
References: [{'name': '80556', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/80556'}, {'name': 'openSUSE-SU-2012:0692', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2012-06/msg00001.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-1185'}, {'name': '49043', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49043'}, {'name': 'DSA-2462', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2462'}, {'name': '51957', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/51957'}, {'name': '[oss-security] 20120319 CVE-2012-1185 / CVE-2012-1186 assignment notification - incomplete  ImageMagick fixes for CVE-2012-0247 / CVE-2012-0248', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2012/03/19/5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/profile.c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://trac.imagemagick.org/changeset/6998/ImageMagick/branches/ImageMagick-6.7.5/magick/property.c'}, {'name': '47926', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/47926'}, {'name': 'USN-1435-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1435-1'}, {'name': 'imagemagick-profile-code-execution(76140)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/76140'}, {'name': '48974', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/48974'}, {'name': '49317', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/49317'}]
CVE State: PUBLISHED