Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-5330 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:41:48.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in BirdBlog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/70610 - http://jvndb.jvn.jp/jvndb/JVNDB-2014-000121 - http://jvn.jp/en/jp/JVN87373393/index.html
CVE ID: CVE-2014-5331 State: PUBLISHED Published: 2014-10-19T01:00:00 Last Updated: 2024-08-06T11:41:48.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Aflax allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://jvndb.jvn.jp/jvndb/JVNDB-2014-000122 - http://jvn.jp/en/jp/JVN66285408/index.html - http://www.securityfocus.com/bid/70605
CVE ID: CVE-2014-5332 State: PUBLISHED Published: 2015-02-06T11:00:00 Last Updated: 2024-08-06T11:41:48.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: Race condition in NVMap in NVIDIA Tegra Linux Kernel 3.10 allows local users to gain privileges via a crafted NVMAP_IOC_CREATE IOCTL call, which triggers a use-after-free error, as demonstrated by using a race condition to escape the Chrome sandbox. Additional Analyst Notes: - CVE Program Container: References: - http://googleprojectzero.blogspot.com/2015/01/exploiting-nvmap-to-escape-chrome.html - http://nvidia.custhelp.com/app/answers/detail/a_id/3618
CVE ID: CVE-2014-5333 State: PUBLISHED Published: 2014-08-19T10:00:00 Last Updated: 2024-08-06T11:41:48.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Adobe Flash Player before 13.0.0.241 and 14.x before 14.0.0.176 on Windows and OS X and before 11.2.202.400 on Linux, Adobe AIR before 14.0.0.178 on Windows and OS X and before 14.0.0.179 on Android, Adobe AIR SDK before 14.0.0.178, and Adobe AIR SDK & Compiler before 14.0.0.178 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the cha
inst JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API, in conjunction with a manipulation involving a '$' (dollar sign) or '(' (open parenthesis) character. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671. Additional Analyst Notes: - CVE Program Container: References: - http://helpx.adobe.com/security/products/flash-player/apsb14-18.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95418 - http://miki.it/blog/2014/8/15/adobe-really-fixed-rosetta-flash-today/
CVE ID: CVE-2014-5334 State: PUBLISHED Published: 2018-01-08T19:00:00 Last Updated: 2024-08-06T11:41:48.599Z Vendors: n/a Products: n/a Problem Types: n/a Description: FreeNAS before 9.3-M3 has a blank admin password, which allows remote attackers to gain root privileges by leveraging a WebGui login. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.freenas.org/issues/5844 - http://www.securityfocus.com/bid/69249 - http://www.openwall.com/lists/oss-security/2014/08/19/2
CVE ID: CVE-2014-5335 State: PUBLISHED Published: 2014-08-25T16:00:00 Last Updated: 2024-08-06T11:41:48.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in innovaphone PBX 10.00 sr11 and earlier allow remote attackers to hijack the authentication of administrators for requests that modify configurations or user accounts, as demonstrated by (1) changing the administrator password via a crafted request to CMD0/mod_cmd.xml or (2) adding a new SIP user via a crafted request to PBX0/ADMIN/mod_cmd_login.xml. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533197/100/0/t
. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533197/100/0/threaded
CVE ID: CVE-2014-5336 State: PUBLISHED Published: 2014-08-26T14:00:00 Last Updated: 2024-08-06T11:41:48.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Monkey HTTP Server before 1.5.3, when the File Descriptor Table (FDT) is enabled and custom error messages are set, allows remote attackers to cause a denial of service (file descriptor consumption) via an HTTP request that triggers an error message. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/95336 - http://www.securityfocus.com/bid/69279 - http://secunia.com/advisories/60783 - http://monkey-project.com/Announcements/v1.5.3 - https://github.com/monkey/m
279 - http://secunia.com/advisories/60783 - http://monkey-project.com/Announcements/v1.5.3 - https://github.com/monkey/monkey/commit/b2d0e6f92310bb14a15aa2f8e96e1fb5379776dd - http://seclists.org/oss-sec/2014/q3/397 - http://seclists.org/oss-sec/2014/q3/412
CVE ID: CVE-2014-5337 State: PUBLISHED Published: 2014-08-29T14:00:00 Last Updated: 2024-08-06T11:41:48.689Z Vendors: n/a Products: n/a Problem Types: n/a Description: The WordPress Mobile Pack plugin before 2.0.2 for WordPress does not properly restrict access to password protected posts, which allows remote attackers to obtain sensitive information via an exportarticles action to export/content.php. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/wordpress-mobile-pack/changelog/ - http://www.securityfocus.com/bid/69292 - http://secunia.com/advisories/60584 - https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-m
//secunia.com/advisories/60584 - https://security.dxw.com/advisories/information-disclosure-vulnerability-in-wordpress-mobile-pack-allows-anybody-to-read-password-protected-posts/
CVE ID: CVE-2014-5338 State: PUBLISHED Published: 2014-08-22T14:00:00 Last Updated: 2024-08-06T11:41:48.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the multisite component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors to the (1) render_status_icons function in htmllib.py or (2) ajax_action function in actions.py. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533180/100/0/threaded - http://mathias-kettner.de/check_mk_werks.php?werk_id=0982&HTML=yes - http://www.
s.com/archive/1/533180/100/0/threaded - http://mathias-kettner.de/check_mk_werks.php?werk_id=0982&HTML=yes - http://www.securityfocus.com/bid/69312 - http://rhn.redhat.com/errata/RHSA-2015-1495.html - http://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/95383
CVE ID: CVE-2014-5339 State: PUBLISHED Published: 2014-09-02T14:00:00 Last Updated: 2024-08-06T11:41:48.576Z Vendors: n/a Products: n/a Problem Types: n/a Description: Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 allows remote authenticated users to write check_mk config files (.mk files) to arbitrary locations via vectors related to row selections. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533180/100/0/threaded - http://rhn.redhat.com/errata/RHSA-2015-1495.html - http://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html - http://mathias-kettner.de/check_mk_werks.php?werk_id=983
CVE ID: CVE-2014-5340 State: PUBLISHED Published: 2014-09-02T14:00:00 Last Updated: 2024-08-06T11:41:48.661Z Vendors: n/a Products: n/a Problem Types: n/a Description: The wato component in Check_MK before 1.2.4p4 and 1.2.5 before 1.2.5i4 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, related to an automation URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/533180/100/0/threaded - http://rhn.redhat.com/errata/RHSA-2015-1495.html - http://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html - http://mathias-kettner
p://packetstormsecurity.com/files/127941/Deutsche-Telekom-CERT-Advisory-DTC-A-20140820-001.html - http://mathias-kettner.de/check_mk_werks.php?werk_id=984
CVE ID: CVE-2014-5341 State: PUBLISHED Published: 2015-02-04T18:00:00 Last Updated: 2024-08-06T11:41:48.702Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SFTP external storage driver (files_external) in ownCloud Server before 6.0.5 validates the RSA Host key after login, which allows remote attackers to obtain sensitive information by sniffing the network. Additional Analyst Notes: - CVE Program Container: References: - https://owncloud.org/security/advisory/?id=oc-sa-2014-019
CVE ID: CVE-2014-5342 State: PUBLISHED Published: 2014-11-19T18:00:00 Last Updated: 2024-08-06T11:41:48.647Z Vendors: n/a Products: n/a Problem Types: n/a Description: Aruba Networks ClearPass before 6.3.5 and 6.4.x before 6.4.1 allows remote attackers to execute arbitrary commands via unspecified vectors, a different vulnerability than CVE-2014-6627. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/61916 - http://www.arubanetworks.com/support/alerts/aid-10282014.txt
CVE ID: CVE-2014-5343 State: PUBLISHED Published: 2014-08-19T18:00:00 Last Updated: 2024-08-06T11:41:48.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Feng Office allows remote attackers to inject arbitrary web script or HTML via a client Name field. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69080 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95173 - http://packetstormsecurity.com/files/127777/Feng-Office-Cross-Site-Scripting.html
CVE ID: CVE-2014-5344 State: PUBLISHED Published: 2014-08-19T18:00:00Z Last Updated: 2024-09-16T23:46:44.159Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site scripting (XSS) vulnerabilities in the Mobiloud (mobiloud-mobile-app-plugin) plugin before 2.3.8 for WordPress allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://wordpress.org/plugins/mobiloud-mobile-app-plugin/changelog - http://secunia.com/advisories/60530
CVE ID: CVE-2014-5345 State: PUBLISHED Published: 2014-08-19T19:00:00Z Last Updated: 2024-09-16T16:58:45.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in upgrade.php in the Disqus Comment System plugin before 2.76 for WordPress allows remote attackers to inject arbitrary web script or HTML via the step parameter. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/disqus-comment-system/other_notes - http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Aug/35 - https://www.nikcub.com/posts/multiple-vulnerab
ss-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Aug/35 - https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin - http://www.securityfocus.com/bid/69205
CVE ID: CVE-2014-5346 State: PUBLISHED Published: 2014-08-19T19:00:00Z Last Updated: 2024-09-17T00:46:18.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) activate or (2) deactivate the plugin via the active parameter to wp-admin/edit-comments.php, (3) import comments via an import_comments action, or (4) export comments via an export_comments action to wp-admin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014
dmin/index.php. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Aug/46 - https://vexatioustendencies.com/csrf-in-disqus-wordpress-plugin-v2-77
CVE ID: CVE-2014-5347 State: PUBLISHED Published: 2014-08-19T19:00:00 Last Updated: 2024-08-06T11:41:48.609Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the Disqus Comment System plugin before 2.76 for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting (XSS) attacks via the (1) disqus_replace, (2) disqus_public_key, or (3) disqus_secret_key parameter to wp-admin/edit-comments.php in manage.php or that (4) reset or (5) delete plugin options via the reset parameter to wp-admin/edit-comments.php. Additional Analyst Notes: - CVE Program Containe
e plugin options via the reset parameter to wp-admin/edit-comments.php. Additional Analyst Notes: - CVE Program Container: References: - https://wordpress.org/plugins/disqus-comment-system/other_notes - http://packetstormsecurity.com/files/127847/WordPress-Disqus-2.7.5-CSRF-Cross-Site-Scripting.html - http://seclists.org/fulldisclosure/2014/Aug/35 - http://packetstormsecurity.com/files/127852/Disqus-2.7.5-Cross-Site-Request-Forgery-Cross-Site-Scripting.html - https://www.nikcub.com/posts/multiple-vulnerabilities-in-disqus-wordpress-plugin - https://gist.github.com/nikcub/cb5dc7a5464276c8424a - https://exchange.xforce.ibmcloud.com/vulnerabilities/95288 - http://www.securityfocus.com/bid/69205
5dc7a5464276c8424a - https://exchange.xforce.ibmcloud.com/vulnerabilities/95288 - http://www.securityfocus.com/bid/69205 - http://www.exploit-db.com/exploits/34336 - https://exchange.xforce.ibmcloud.com/vulnerabilities/95289
CVE ID: CVE-2014-5348 State: PUBLISHED Published: 2014-08-19T19:00:00Z Last Updated: 2024-09-16T23:45:26.023Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in apps/zxtm/locallog.cgi in Riverbed Stingray (aka SteelApp) Traffic Manager Virtual Appliance 9.6 patchlevel 9620140312 allows remote attackers to inject arbitrary web script or HTML via the logfile parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Aug/41 - http://www.securityfocus.com/bid/69243
CVE ID: CVE-2014-5349 State: PUBLISHED Published: 2014-08-19T19:00:00Z Last Updated: 2024-09-16T19:20:46.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in Baidu Spark Browser 26.5.9999.3511 allows remote attackers to cause a denial of service (application crash) via nested calls to the window.print JavaScript function. Additional Analyst Notes: - CVE Program Container: References: - http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5190.php - http://www.exploit-db.com/exploits/33951 - http://osvdb.org/show/osvdb/108605
CVE ID: CVE-2014-5350 State: PUBLISHED Published: 2014-08-19T19:00:00Z Last Updated: 2024-09-16T18:55:41.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple directory traversal vulnerabilities in Bitdefender GravityZone before 5.1.11.432 allow remote attackers to read arbitrary files via a (1) .. (dot dot) in the id parameter to webservice/CORE/downloadFullKitEpc/a/1 in the Web Console or (2) %2E%2E (encoded dot dot) in the default URI to port 7074 on the Update Server. Additional Analyst Notes: - CVE Program Container: References: - https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-3_Bitdefender_GravityZone_Multiple_critical_vulnerabilities
sult.com/fxdata/seccons/prod/temedia/advisories_txt/20140716-3_Bitdefender_GravityZone_Multiple_critical_vulnerabilities_v10.txt - http://seclists.org/fulldisclosure/2014/Jul/78 - http://www.bitdefender.com/support/how-to-configure-iptables-firewall-rules-on-gravityzone-for-restricting-outside-access-to-mongodatabase-1265.html
CVE ID: CVE-2014-5351 State: PUBLISHED Published: 2014-10-10T01:00:00 Last Updated: 2024-08-06T11:41:49.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access. Additional Analyst Notes: - CVE Program Container: References: - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8018 - http://www.securitytracker.com/id/1031003 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - https:
curitytracker.com/id/1031003 - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html - http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html - http://advisories.mageia.org/MGASA-2014-0477.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - https://bugzilla.redhat.com/show_bug.cgi?id=1145425 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:224 - http://security.gentoo.org/glsa/glsa-201412-53.xml - http://www.ubuntu.com/usn/USN-2498-1 - http://www.securityfocus.com/bid/70380 - https://exchange.xforce.ibmcloud.com/vulnerabilities/97028 - https:/
N-2498-1 - http://www.securityfocus.com/bid/70380 - https://exchange.xforce.ibmcloud.com/vulnerabilities/97028 - https://github.com/krb5/krb5/commit/af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca - http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140132.html
CVE ID: CVE-2014-5352 State: PUBLISHED Published: 2015-02-19T11:00:00 Last Updated: 2024-08-06T11:41:48.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly maintain security-context handles, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. Additional Analyst Notes: - CVE Program Contain
code via crafted GSSAPI traffic, as demonstrated by traffic to kadmind. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151437.html - http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2015-001.txt - http://rhn.redhat.com/errata/RHSA-2015-0794.html - http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151103.html - http://www.debian.org/security/2015/dsa-3153 - http://lists.opensuse.org/opensuse-updates/2015-02/msg00044.html - http://rhn.redhat.com/errata/RHSA-2015-0439.html - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - http://www.mandriva.com/security/advis
ml - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00016.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.ubuntu.com/usn/USN-2498-1 - http://lists.opensuse.org/opensuse-security-announce/2015-02/msg00011.html - http://www.securityfocus.com/bid/72495 - https://github.com/krb5/krb5/commit/82dc33da50338ac84c7b4102dc6513d897d0506a - http://web.mit.edu/kerberos/advisories/2015-001-patch-r113.txt
CVE ID: CVE-2014-5353 State: PUBLISHED Published: 2014-12-16T23:00:00 Last Updated: 2024-08-06T11:41:49.048Z Vendors: n/a Products: n/a Problem Types: n/a Description: The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0794.html - https://lists.debian.org/debian-lts-announce/2018/0
er: References: - http://rhn.redhat.com/errata/RHSA-2015-0794.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773226 - http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155828.html - http://www.mandriva.com/security/advisories?name=MDVSA-2015:009 - http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html - http://www.securitytracker.com/id/1031376 - http://rhn.redhat.com/errata/RHSA-2015-0439.html - http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html - https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3 - http://www.ubuntu.com/usn/USN-24
9.html - https://github.com/krb5/krb5/commit/d1f707024f1d0af6e54a18885322d70fa15ec4d3 - http://www.ubuntu.com/usn/USN-2498-1 - http://www.securityfocus.com/bid/71679 - http://advisories.mageia.org/MGASA-2014-0536.html
CVE ID: CVE-2014-5354 State: PUBLISHED Published: 2014-12-16T23:00:00 Last Updated: 2024-08-06T11:41:49.227Z Vendors: n/a Products: n/a Problem Types: n/a Description: plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) by creating a database entry for a keyless principal, as demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html - http://www.securityfocus.c
m Container: References: - http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html - http://www.securityfocus.com/bid/71680 - http://www.securitytracker.com/id/1031376 - http://www.ubuntu.com/usn/USN-2498-1 - https://github.com/krb5/krb5/commit/04038bf3633c4b909b5ded3072dc88c8c419bf16
CVE ID: CVE-2014-5355 State: PUBLISHED Published: 2015-02-20T11:00:00 Last Updated: 2024-08-06T11:41:49.279Z Vendors: n/a Products: n/a Problem Types: n/a Description: MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NULL pointer dereference) via a zero-byte version string or (2) cause a denial of service (out-of-bounds read) by omitting the '\0' character, related to appl/user_user/server.c and lib/krb5/krb/recvauth.c. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-079
/recvauth.c. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2015-0794.html - https://lists.debian.org/debian-lts-announce/2018/01/msg00040.html - http://lists.opensuse.org/opensuse-updates/2015-03/msg00061.html - http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html - https://github.com/krb5/krb5/commit/102bb6ebf20f9174130c85c3b052ae104e5073ec - http://www.mandriva.com/security/advisories?name=MDVSA-2015:069 - http://www.oracle.com/technetwork/topics/security/bulletinjan2015-2370101.html - http://www.securityfocus.com/bid/74042 - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 - http://www.ubuntu.com/usn/U
p://www.securityfocus.com/bid/74042 - http://krbdev.mit.edu/rt/Ticket/Display.html?id=8050 - http://www.ubuntu.com/usn/USN-2810-1