Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2013-1770
Cross-site scripting (XSS) vulnerability in views_view.php in Ganglia Web 3.5.7 allows remote attackers to inject arbitrary web script or HTML via the view_name parameter.
Affected Products: n/a
References: [{'name': '[oss-security] 20130226 Re: CVE request: XSS flaws fixed in ganglia', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/11'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ganglia/ganglia-web/commit/552965f33bf79d41ccbec3f1f26840c8bab54ad6'}, {'name': 'ganglia-viewsview-xss(82468)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82468'}, {'name': '[oss-security] 20130221 Re: CVE request: XSS flaws fixed in ganglia', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/21/12'}, {'name': '52673', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52673'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/ganglia/ganglia-web/issues/160'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=892823'}]
CVE State: PUBLISHED
Explain CVE-2013-1771
The web server Monkeyd produces a world-readable log (/var/log/monkeyd/master.log) on gentoo.
Affected Products: monkey
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-tracker.debian.org/tracker/CVE-2013-1771'}, {'tags': ['x_refsource_MISC'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/10'}]
CVE State: PUBLISHED
Explain CVE-2013-1772
The log_prefix function in kernel/printk.c in the Linux kernel 3.x before 3.4.33 does not properly remove a prefix string from a syslog header, which allows local users to cause a denial of service (buffer overflow and system crash) by leveraging /dev/kmsg write access and triggering a call_console_drivers function call.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/ce0030c00f95cf9110d9cdcd41e901e1fb814417'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'name': '[oss-security] 20130226 Re: CVE request -- Linux kernel: call_console_drivers() Function Log Prefix Stripping buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916075'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.33'}]
CVE State: PUBLISHED
Explain CVE-2013-1773
Buffer overflow in the VFAT filesystem implementation in the Linux kernel before 3.3 allows local users to gain privileges or cause a denial of service (system crash) via a VFAT write operation on a filesystem with the utf8 mount option, which is not properly handled during UTF-8 to UTF-16 conversion.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916115'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': '[oss-security] 20130226 Re: CVE request - Linux kernel: VFAT slab-based buffer overflow', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/26/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0720a06a7518c9d0c0125bd5d1f3b6264c55c3dd'}, {'name': '23248', 'tags': ['exploit', 'x_refsource_EXPLOIT-DB'], 'url': 'http://www.exploit-db.com/exploits/23248/'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.3.bz2'}, {'name': '58200', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58200'}, {'name': '88310', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/88310'}, {'name': 'RHSA-2013:1026', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1026.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1774
The chase_port function in drivers/usb/serial/io_ti.c in the Linux kernel before 3.7.4 allows local users to cause a denial of service (NULL pointer dereference and system crash) via an attempted /dev/ttyUSB read or write operation on a disconnected Edgeport USB serial converter.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0847', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916191'}, {'name': 'USN-1805-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1805-1'}, {'name': 'USN-1808-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1808-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1ee0a224bc9aad1de496c795f96bc6ba2c394811'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/1ee0a224bc9aad1de496c795f96bc6ba2c394811'}, {'name': 'SUSE-SU-2013:1474', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-09/msg00004.html'}, {'name': '[oss-security] 20130227 Re: CVE request: Linux kernel: USB: io_ti: NULL pointer dereference', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/27/29'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'name': 'SUSE-SU-2013:1182', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00016.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://xorl.wordpress.com/2013/05/18/cve-2013-1774-linux-kernel-edgeport-usb-serial-converter-null-pointer-dereference/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.4'}]
CVE State: PUBLISHED
Explain CVE-2013-1775
sudo 1.6.0 through 1.7.10p6 and sudo 1.8.0 through 1.8.6p6 allows local users or physically proximate attackers to bypass intended time restrictions and retain privileges without re-authenticating by setting the system clock and sudo user timestamp to the epoch.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': '58203', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58203'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/repos/sudo/rev/ddf399e3e306'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/sudo/alerts/epoch_ticket.html'}, {'name': '90677', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90677'}, {'name': 'RHSA-2013:1701', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1701.html'}, {'name': 'DSA-2642', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2642'}, {'name': 'openSUSE-SU-2013:0495', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00066.html'}, {'name': 'USN-1754-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1754-1'}, {'name': 'APPLE-SA-2015-08-13-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html'}, {'name': 'APPLE-SA-2013-09-12-1', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html'}, {'name': 'SSA:2013-065-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.517440'}, {'name': '[oss-security] 20130227 CVE request: sudo authentication bypass when clock is reset', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/27/22'}, {'name': 'RHSA-2013:1353', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1353.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT205031'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/repos/sudo/rev/ebd6cc75020f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://support.apple.com/kb/HT5880'}]
CVE State: PUBLISHED
Explain CVE-2013-1776
sudo 1.3.5 through 1.7.10 and 1.8.0 through 1.8.5, when the tty_tickets option is enabled, does not properly validate the controlling terminal device, which allows local users with sudo permissions to hijack the authorization of another terminal via vectors related to connecting to the standard input, output, and error file descriptors of another terminal.  NOTE: this is one of three closely-related vulnerabilities that were originally assigned CVE-2013-1776, but they have been SPLIT because of different affected versions.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': '58207', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58207'}, {'tags': ['x_refsource_MISC'], 'url': 'http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=701839'}, {'name': 'DSA-2642', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2642'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/repos/sudo/rev/6b22be4d09f0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/repos/sudo/rev/632f8e028191'}, {'name': '[oss-security] 20130227 Re: CVE request: potential bypass of sudo tty_tickets  constraints', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/27/31'}, {'name': 'openSUSE-SU-2013:0495', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-03/msg00066.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.sudo.ws/sudo/alerts/tty_tickets.html'}, {'name': 'APPLE-SA-2015-08-13-2', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html'}, {'name': 'SSA:2013-065-01', 'tags': ['vendor-advisory', 'x_refsource_SLACKWARE'], 'url': 'http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.517440'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugs.launchpad.net/ubuntu/+source/sudo/+bug/87023'}, {'name': 'RHSA-2013:1353', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1353.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT205031'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916365'}, {'name': 'sudo-ttytickets-sec-bypass(82453)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82453'}]
CVE State: PUBLISHED
Explain CVE-2013-1777
The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www-01.ibm.com/support/docview.wss?uid=swg21643282'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://issues.apache.org/jira/browse/GERONIMO-6477'}, {'name': '20130701 [SECURITY] CVE-2013-1777: Apache Geronimo 3 RMI classloader exposure', 'tags': ['mailing-list', 'x_refsource_BUGTRAQ'], 'url': 'http://archives.neohapsis.com/archives/bugtraq/2013-07/0008.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://geronimo.apache.org/30x-security-report.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1778
Cross-site scripting (XSS) vulnerability in the Creative Theme 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/creative.git/commitdiff/465367c'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929474'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1929380'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}]
CVE State: PUBLISHED
Explain CVE-2013-1779
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Fresh theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1723316'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929482'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/fresh.git/commitdiff/08a3ccb'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}]
CVE State: PUBLISHED
Explain CVE-2013-1780
Cross-site scripting (XSS) vulnerability in the Best Responsive Theme 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Affected Products: n/a
References: [{'name': '90690', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90690'}, {'name': '58213', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58213'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/best_responsive.git/commitdiff/5972126'}, {'name': '52421', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52421'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929484'}, {'name': 'bestresponsive-socialicon-xss(82469)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82469'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1929390'}]
CVE State: PUBLISHED
Explain CVE-2013-1781
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Professional theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/professional_theme.git/commitdiff/e3fa6a2'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1730768'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/professional_theme.git/commitdiff/0640ddc'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929486'}]
CVE State: PUBLISHED
Explain CVE-2013-1782
Cross-site scripting (XSS) vulnerability in the Responsive Blog Theme 7.x-1.x before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via vectors related to social icons.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929488'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/responsive_blog.git/commitdiff/ce47de9'}, {'name': '58218', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58218'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'name': '90688', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90688'}, {'name': '52423', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52423'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1929396'}]
CVE State: PUBLISHED
Explain CVE-2013-1783
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in page--front.tpl.php in the Business theme before 7.x-1.8 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'name': '52424', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52424'}, {'name': '58216', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58216'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929496'}, {'name': '90685', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://osvdb.org/90685'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/business.git/commitdiff/02f081f'}, {'name': 'business-3slidegallery-xss(82460)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82460'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1723246'}]
CVE State: PUBLISHED
Explain CVE-2013-1784
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Clean Theme before 7.x-1.3 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1723532'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929500'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/clean_theme.git/commitdiff/ff2da6f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/clean_theme.git/commitdiff/697f839'}]
CVE State: PUBLISHED
Explain CVE-2013-1785
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Premium Responsive theme before 7.x-1.6 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929508'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/responsive.git/commitdiff/1c6fa91'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1730752'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/responsive.git/commitdiff/6b593ff'}]
CVE State: PUBLISHED
Explain CVE-2013-1786
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Company theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/company.git/commitdiff/9ddac7e'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1724232'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/company.git/commitdiff/d9a99da'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929512'}]
CVE State: PUBLISHED
Explain CVE-2013-1787
Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the Simple Corporate theme before 7.x-1.4 for Drupal allows remote authenticated users with the administer themes permission to inject arbitrary web script or HTML via unspecified vectors.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'http://drupal.org/node/1929514'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupal.org/node/1730786'}, {'name': '[oss-security] 20130227 Re: CVE Request for Drupal Contributed Modules', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/3'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://drupalcode.org/project/corporate.git/commitdiff/679a1d3'}]
CVE State: PUBLISHED
Explain CVE-2013-1788
poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors that trigger an "invalid memory access" in (1) splash/Splash.cc, (2) poppler/Function.cc, and (3) poppler/Stream.cc.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=957aa252912cde85d76c41e9710b33425a82b696'}, {'name': 'FEDORA-2013-3457', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100090.html'}, {'name': 'MDVSA-2013:143', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:143'}, {'name': 'FEDORA-2013-3473', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100081.html'}, {'name': 'USN-1785-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1785-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917108'}, {'tags': ['x_refsource_MISC'], 'url': 'http://j00ru.vexillium.org/?p=1507'}, {'name': 'DSA-2719', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2719'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=0388837f01bc467045164f9ddaff787000a8caaa'}, {'name': '52846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52846'}, {'name': '[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/8'}, {'name': '[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=e14b6e9c13d35c9bd1e0c50906ace8e707816888'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=bbc2d8918fe234b7ef2c480eb148943922cc0959'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=8b6dc55e530b2f5ede6b9dfb64aafdd1d5836492'}]
CVE State: PUBLISHED
Explain CVE-2013-1789
splash/Splash.cc in poppler before 0.22.1 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via vectors related to the (1) Splash::arbitraryTransformMask, (2) Splash::blitMask, and (3) Splash::scaleMaskYuXu functions.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-3457', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100090.html'}, {'name': 'FEDORA-2013-3473', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100081.html'}, {'name': 'USN-1785-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1785-1'}, {'tags': ['x_refsource_MISC'], 'url': 'http://j00ru.vexillium.org/?p=1507'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917109'}, {'name': '52846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52846'}, {'name': '[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=a205e71a2dbe0c8d4f4905a76a3f79ec522eacec'}, {'name': '[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=a9b8ab4657dec65b8b86c225d12c533ad7e984e2'}]
CVE State: PUBLISHED
Explain CVE-2013-1790
poppler/Stream.cc in poppler before 0.22.1 allows context-dependent attackers to have an unspecified impact via vectors that trigger a read of uninitialized memory by the CCITTFaxStream::lookChar function.
Affected Products: n/a
References: [{'name': 'FEDORA-2013-3457', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100090.html'}, {'name': 'MDVSA-2013:143', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:143'}, {'name': 'FEDORA-2013-3473', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100081.html'}, {'name': 'USN-1785-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1785-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917111'}, {'tags': ['x_refsource_MISC'], 'url': 'http://j00ru.vexillium.org/?p=1507'}, {'name': 'DSA-2719', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2719'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://cgit.freedesktop.org/poppler/poppler/commit/?h=poppler-0.22&id=b1026b5978c385328f2a15a2185c599a563edf91'}, {'name': '52846', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52846'}, {'name': '[oss-security] 20130228 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/8'}, {'name': '[oss-security] 20130227 Re: CVE Request: poppler 0.22.1 security fixes', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/02/28/4'}]
CVE State: PUBLISHED
Explain CVE-2013-1792
Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
Affected Products: n/a
References: [{'name': 'USN-1796-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1796-1'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/0da9dfdd2cd9889201bc6f6f43580c99165cd087'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'USN-1797-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1797-1'}, {'name': 'USN-1788-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1788-1'}, {'name': '[oss-security] 20130307 CVE-2013-1792 Linux kernel: KEYS: race with concurrent install_user_keyrings()', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/07/1'}, {'name': 'USN-1793-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1793-1'}, {'name': 'USN-1792-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1792-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0da9dfdd2cd9889201bc6f6f43580c99165cd087'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=916646'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.8.3'}, {'name': 'USN-1794-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1794-1'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': 'USN-1795-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1795-1'}, {'name': 'USN-1787-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1787-1'}, {'name': 'openSUSE-SU-2014:0204', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html'}, {'name': 'USN-1798-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1798-1'}]
CVE State: PUBLISHED
Explain CVE-2013-1793
openstack-utils openstack-db has insecure password creation
Affected Products: openstack-db program
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-1793'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/cve-2013-1793'}]
CVE State: PUBLISHED
Explain CVE-2013-1794
Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/pages/security/OPENAFS-SA-2013-001.txt'}, {'name': '52480', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52480'}, {'name': '52342', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52342'}, {'name': 'DSA-2638', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2638'}, {'name': 'MDVSA-2014:244', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:244'}, {'name': '58299', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58299'}, {'name': 'openafs-fileserver-bo(82582)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82582'}]
CVE State: PUBLISHED
Explain CVE-2013-1795
Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
Affected Products: n/a
References: [{'name': '52480', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52480'}, {'name': 'openafs-ptserver-overflow(82585)', 'tags': ['vdb-entry', 'x_refsource_XF'], 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/82585'}, {'name': '52342', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52342'}, {'name': 'DSA-2638', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2013/dsa-2638'}, {'name': '58300', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58300'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.openafs.org/pages/security/OPENAFS-SA-2013-002.txt'}, {'name': 'MDVSA-2014:244', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2014:244'}]
CVE State: PUBLISHED
Explain CVE-2013-1796
The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0847', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'name': 'USN-1812-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1812-1'}, {'name': 'USN-1805-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1805-1'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': '58607', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58607'}, {'name': 'USN-1808-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1808-1'}, {'name': 'USN-1809-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1809-1'}, {'name': 'RHSA-2013:0727', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0727.html'}, {'name': '[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/20/9'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': 'RHSA-2013:0746', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0746.html'}, {'name': 'USN-1813-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1813-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c300aa64ddf57d9c5d9c898a64b36877345dd4a9'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/c300aa64ddf57d9c5d9c898a64b36877345dd4a9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917012'}, {'name': 'RHSA-2013:1026', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1026.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1797
Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0847', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'name': 'USN-1812-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1812-1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0b79459b482e85cb7426aa7da683a9f2c97aeae1'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': 'USN-1809-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1809-1'}, {'name': 'RHSA-2013:0727', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0727.html'}, {'name': '[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/20/9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917013'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/0b79459b482e85cb7426aa7da683a9f2c97aeae1'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': 'RHSA-2013:0746', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0746.html'}, {'name': 'USN-1813-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1813-1'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'name': 'RHSA-2013:1026', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1026.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1798
The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
Affected Products: n/a
References: [{'name': 'openSUSE-SU-2013:0847', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html'}, {'name': 'openSUSE-SU-2013:1187', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a2c118bfab8bc6b8bb213abfc35201e441693d55'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/torvalds/linux/commit/a2c118bfab8bc6b8bb213abfc35201e441693d55'}, {'name': 'USN-1812-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1812-1'}, {'name': 'MDVSA-2013:176', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:176'}, {'name': 'RHSA-2013:0928', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0928.html'}, {'name': 'USN-1809-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1809-1'}, {'name': 'RHSA-2013:0727', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0727.html'}, {'name': '[oss-security] 20130320 linux kernel: kvm: CVE-2013-179[6..8]', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2013/03/20/9'}, {'name': 'RHSA-2013:0744', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0744.html'}, {'name': 'RHSA-2013:0746', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0746.html'}, {'name': 'USN-1813-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1813-1'}, {'name': 'openSUSE-SU-2013:0925', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917017'}, {'name': 'RHSA-2013:1026', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-1026.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/157233/Kernel-Live-Patch-Security-Notice-LSN-0065-1.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1799
Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network.  NOTE: this issue exists because of an incomplete fix for CVE-2013-0240.
Affected Products: n/a
References: [{'name': '[gnome-announce-list] 20130305 GNOME Online Accounts 3.7.91 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8'}, {'name': '51976', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/51976'}, {'name': '[gnome-announce-list] 20130304 GNOME Online Accounts 3.6.3 released', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=695106'}, {'name': 'USN-1779-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://ubuntu.com/usn/usn-1779-1'}, {'name': '52791', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52791'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.gnome.org/show_bug.cgi?id=693214'}, {'name': 'openSUSE-SU-2013:0301', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html'}]
CVE State: PUBLISHED
Explain CVE-2013-1800
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917236'}, {'name': '52897', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/52897'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://bugzilla.novell.com/show_bug.cgi?id=804721'}, {'name': 'SUSE-SU-2013:0615', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00003.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6'}]
CVE State: PUBLISHED
Explain CVE-2013-1801
The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031'}, {'tags': ['x_refsource_MISC'], 'url': 'https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917229'}, {'name': '58260', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/58260'}]
CVE State: PUBLISHED
Explain CVE-2013-1802
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d22879b5...4540e7102b803624cc2eade4bb8aaaa934fc31c5'}, {'name': 'SUSE-SU-2013:0612', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00002.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=917233'}]
CVE State: PUBLISHED