Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2013-4442 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T16:45:14.303Z Vendors: n/a Products: n/a Problem Types: n/a Description: Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/06/06/1 - http://sourceforge.net/p/pwgen/code/ci/00118ccac4656adb028504639b313d7b09e62b79/ - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672241 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146237.
n.org/cgi-bin/bugreport.cgi?bug=672241 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146237.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146015.html - http://www.openwall.com/lists/oss-security/2013/10/16/15 - http://www.mandriva.com/security/advisories?name=MDVSA-2015:008 - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146285.html - http://advisories.mageia.org/MGASA-2014-0535.html
CVE ID: CVE-2013-4443 State: REJECTED Published: 2013-10-24T10:00:00Z Last Updated: 2024-09-16T21:02:37.993Z Description: No description available.
CVE ID: CVE-2013-4444 State: PUBLISHED Published: 2014-09-12T01:00:00 Last Updated: 2024-08-06T16:45:14.245Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69728 - http://tomcat.apache.org/security-7.html - http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://www.securitytracker.com/id/1030834 - https:
ww.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html - http://www.securitytracker.com/id/1030834 - https://h20564.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04851013 - http://marc.info/?l=bugtraq&m=144498216801440&w=2 - http://openwall.com/lists/oss-security/2014/10/24/12 - http://archives.neohapsis.com/archives/bugtraq/2014-09/0075.html - http://www.debian.org/security/2016/dsa-3447 - http://seclists.org/fulldisclosure/2021/Jan/23
CVE ID: CVE-2013-4445 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T16:45:14.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: The json rendering functionality in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal uses Drupal's token scheme to restrict access to blocks, which makes it easier for remote authenticated users to guess the access token for a block by leveraging the token from a block to which the user has access. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html - https://drupal.org/node/2113317 - https://drupal.o
oraproject.org/pipermail/package-announce/2013-November/122308.html - https://drupal.org/node/2113317 - https://drupal.org/node/2112785 - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html - https://drupal.org/node/2112791
CVE ID: CVE-2013-4446 State: PUBLISHED Published: 2013-12-07T20:00:00 Last Updated: 2024-08-06T16:45:14.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: The _json_decode function in plugins/context_reaction_block.inc in the Context module 6.x-2.x before 6.x-3.2 and 7.x-3.x before 7.x-3.0 for Drupal, when using a version of PHP that does not support the json_decode function, allows remote attackers to execute arbitrary PHP code via unspecified vectors related to Ajax operations, possibly involving eval injection. Additional Analyst Notes: - CVE Program Container: References: - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html - https://drupal.o
er: References: - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122308.html - https://drupal.org/node/2113317 - https://drupal.org/node/2112785 - http://drupalcode.org/project/context.git/commitdiff/63ef4d9 - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/121433.html - http://drupalcode.org/project/context.git/commitdiff/d7b4afa - http://lists.fedoraproject.org/pipermail/package-announce/2013-November/122298.html - https://drupal.org/node/2112791
CVE ID: CVE-2013-4447 State: PUBLISHED Published: 2013-11-01T14:00:00 Last Updated: 2024-08-06T16:45:14.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the API in the Simplenews module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via an email address. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/123660/Drupal-Simplenews-6.x-7.x-Cross-Site-Scripting.html - https://drupal.org/node/2113491 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88101 - http://secunia.com/advisories/55209 - http://seclis
13491 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88101 - http://secunia.com/advisories/55209 - http://seclists.org/fulldisclosure/2013/Oct/120 - https://drupal.org/node/2113515 - https://drupal.org/node/2113487 - http://osvdb.org/98628
CVE ID: CVE-2013-4448 State: REJECTED Published: 2020-02-11T17:42:55 Last Updated: 2020-02-17T16:58:57 Description: No description available.
CVE ID: CVE-2013-4449 State: PUBLISHED Published: 2014-02-05T18:00:00 Last Updated: 2024-08-06T16:45:14.585Z Vendors: n/a Products: n/a Problem Types: n/a Description: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search. Additional Analyst Notes: - CVE Program Container: References: - http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html - http://www.openldap.org/its/index.cgi/Incoming?id=7723 - http://www.
k/topics/security/ovmbulletinjul2016-3090546.html - http://www.openldap.org/its/index.cgi/Incoming?id=7723 - http://www.mandriva.com/security/advisories?name=MDVSA-2014:026 - https://bugzilla.redhat.com/show_bug.cgi?id=1019490 - http://www.debian.org/security/2015/dsa-3209 - http://rhn.redhat.com/errata/RHSA-2014-0126.html - http://www.openwall.com/lists/oss-security/2013/10/19/3 - http://rhn.redhat.com/errata/RHSA-2014-0206.html - http://www.securityfocus.com/bid/63190 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://www.securitytracker.com/id/1029711 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449 - http://kb.juniper.net/InfoCent
9711 - http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-4449 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735 - https://support.apple.com/kb/HT210788 - https://seclists.org/bugtraq/2019/Dec/23 - http://seclists.org/fulldisclosure/2019/Dec/26
CVE ID: CVE-2013-4450 State: PUBLISHED Published: 2013-10-21T17:00:00 Last Updated: 2024-08-06T16:45:14.825Z Vendors: n/a Products: n/a Problem Types: n/a Description: The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response. Additional Analyst Notes: - CVE Program Container: References: - https://kb.juniper.net/JSA10783 - http://rhn.redhat.com/errata/RHSA-2013-1842.html - http://lists.opensuse.org/opensuse-updates/2013-12/msg00051.html - http://www.openwall.com/lists/oss-security/2013/10/20/1 - http://www.securityfocus
nsuse-updates/2013-12/msg00051.html - http://www.openwall.com/lists/oss-security/2013/10/20/1 - http://www.securityfocus.com/bid/63229 - http://blog.nodejs.org/2013/10/18/node-v0-10-21-stable/ - http://blog.nodejs.org/2013/10/18/node-v0-8-26-maintenance/ - https://github.com/rapid7/metasploit-framework/pull/2548 - https://groups.google.com/forum/#%21topic/nodejs/NEbweYB0ei0 - https://github.com/joyent/node/issues/6214
CVE ID: CVE-2013-4451 State: PUBLISHED Published: 2018-09-21T17:00:00 Last Updated: 2024-08-06T16:45:14.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: gitolite commit fa06a34 through 3.5.3 might allow attackers to have unspecified impact via vectors involving world-writable permissions when creating (1) ~/.gitolite.rc, (2) ~/.gitolite, or (3) ~/repositories/gitolite-admin.git on fresh installs. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2013/10/21/11 - https://www.securityfocus.com/bid/63237 - https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3 - https://groups.google.com/forum
- https://github.com/sitaramc/gitolite/commit/3dad4f8e3214d6ab5f71823019a624fa48b055a3 - https://groups.google.com/forum/#%21topic/gitolite/Tu1sjaf7A4A/discussion
CVE ID: CVE-2013-4452 State: PUBLISHED Published: 2013-12-24T19:00:00 Last Updated: 2024-08-06T16:45:14.881Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1029390 - http://www.securityfocus.com/bid/63916 - http://secunia.com/advisories/55852 - http://rhn.redhat.com/errata/RHSA-2013-1762.html
CVE ID: CVE-2013-4453 State: PUBLISHED Published: 2013-11-05T20:00:00 Last Updated: 2024-08-06T16:45:14.246Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in templates/login.php in LDAP Account Manager (LAM) 4.3 and 4.2.1 allows remote attackers to inject arbitrary web script or HTML via the language parameter. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/149 - http://osvdb.org/98828 - http://secunia.com/advisories/55413 - http://www.rusty-ice.de/advisory/advisory_2013001.txt - http://sourceforge.net/p/lam/bugs/156 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88203 - http:/
013001.txt - http://sourceforge.net/p/lam/bugs/156 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88203 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=726976
CVE ID: CVE-2013-4454 State: PUBLISHED Published: 2020-02-18T13:23:13 Last Updated: 2024-08-06T16:45:14.823Z Vendors: Portable phpMyAdmin Plugin authors Products: Portable phpMyAdmin Plugin Problem Types: Security Bypass Description: WordPress Portable phpMyAdmin Plugin 1.4.1 has Multiple Security Bypass Vulnerabilities Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/63249 - http://www.openwall.com/lists/oss-security/2013/10/22/3 - http://www.openwall.com/lists/oss-security/2013/10/22/9 - http://www.openwall.com/lists/oss-security/2013/10/23/2 - http://www.openwall.com/lists/oss-security/2013/10/23/9 - https://exchange.xforce.ibmcloud.com/vul
curity/2013/10/23/2 - http://www.openwall.com/lists/oss-security/2013/10/23/9 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88184 - https://exchange.xforce.ibmcloud.com/vulnerabilities/88189
CVE ID: CVE-2013-4455 State: PUBLISHED Published: 2014-05-14T19:00:00 Last Updated: 2024-08-06T16:45:14.451Z Vendors: n/a Products: n/a Problem Types: n/a Description: Katello Installer before 0.0.18 uses world-readable permissions for /etc/pki/tls/private/katello-node.key when deploying a child Pulp node, which allows local users to obtain the private key by reading the file. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1021784 - https://github.com/Katello/katello-installer/commit/15e01086bcb3f5d42525730e8b162bca11bec85e
CVE ID: CVE-2013-4456 State: REJECTED Published: 2022-06-30T20:10:43 Last Updated: 2022-06-30T20:10:43 Description: No description available.
CVE ID: CVE-2013-4457 State: PUBLISHED Published: 2013-11-02T18:00:00Z Last Updated: 2024-09-16T16:17:32.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thoughtbot/cocaine/blob/master/NEWS.md - http://osvdb.org/98835 - http://www.openwall.com/lists/oss-security/2013/10/22/10 - http://secunia.com/advisories/55365
CVE ID: CVE-2013-4458 State: PUBLISHED Published: 2013-12-12T18:00:00 Last Updated: 2024-08-06T16:45:14.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in GNU C Library (aka glibc or libc6) 2.18 and earlier allows remote attackers to cause a denial of service (crash) via a (1) hostname or (2) IP address that triggers a large number of AF_INET6 address results. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1914. Additional Analyst Notes: - CVE Program Container: References: - https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html - http://lists.opensuse.org/op
ogram Container: References: - https://sourceware.org/ml/libc-alpha/2013-10/msg00733.html - http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.html - http://www.mandriva.com/security/advisories?name=MDVSA-2013:284 - https://security.gentoo.org/glsa/201503-04 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:283 - https://sourceware.org/bugzilla/show_bug.cgi?id=16072
CVE ID: CVE-2013-4459 State: PUBLISHED Published: 2013-11-23T18:00:00 Last Updated: 2024-08-06T16:45:14.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: LightDM 1.7.5 through 1.8.3 and 1.9.x before 1.9.2 does not apply the AppArmor profile to the Guest account, which allows local users to bypass intended restrictions by leveraging the Guest account. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2012-1 - https://bugs.launchpad.net/ubuntu/%2Bsource/lightdm/%2Bbug/1243339 - http://lists.freedesktop.org/archives/lightdm/2013-October/000471.html - http://lists.freedesktop.org/archives/lightdm/2013-October/000472.html
CVE ID: CVE-2013-4460 State: PUBLISHED Published: 2014-01-10T15:00:00 Last Updated: 2024-08-06T16:45:14.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name. Additional Analyst Notes: - CVE Program Container: References: - http://www.mantisbt.org/bugs/view.php?id=16513 - http://osvdb.org/98823 - https://github.com/mantisbt/mantisbt/commit/0002d106a6cd35cb0a6fe03246531a4e3f32c9d0#diff-4122320b011a3291cd45da074a867076 - http://seclists.org/oss-sec/2013/q4/168 - http://secunia.com/advisories/5
32c9d0#diff-4122320b011a3291cd45da074a867076 - http://seclists.org/oss-sec/2013/q4/168 - http://secunia.com/advisories/55305
CVE ID: CVE-2013-4461 State: PUBLISHED Published: 2013-12-23T22:00:00 Last Updated: 2024-08-06T16:45:14.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in the web interface for cumin in Red Hat Enterprise MRG Grid 2.4 allows remote attackers to execute arbitrary SQL commands via vectors related to the "filtering table operator." Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1016263 - http://rhn.redhat.com/errata/RHSA-2013-1851.html - http://rhn.redhat.com/errata/RHSA-2013-1852.html
CVE ID: CVE-2013-4462 State: PUBLISHED Published: 2020-01-27T14:09:48 Last Updated: 2024-08-06T16:45:14.643Z Vendors: Portable phpMyAdmin Plugin authors Products: Portable phpMyAdmin Plugin Problem Types: auth bypass Description: WordPress Portable phpMyAdmin Plugin has an authentication bypass vulnerability Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/63249 - http://www.openwall.com/lists/oss-security/2013/10/24/1
CVE ID: CVE-2013-4463 State: PUBLISHED Published: 2014-02-06T02:00:00 Last Updated: 2024-08-06T16:45:14.837Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/nova/+bug/1206081 - http://www.openwall.com/lists/oss-security/2013/10/31/3 - http://www.ubuntu.com/usn/USN-2247-1 - http://rhn.redhat.com/erra
p://www.openwall.com/lists/oss-security/2013/10/31/3 - http://www.ubuntu.com/usn/USN-2247-1 - http://rhn.redhat.com/errata/RHSA-2014-0112.html
CVE ID: CVE-2013-4464 State: REJECTED Published: 2022-06-30T20:12:19 Last Updated: 2022-06-30T20:12:19 Description: No description available.
CVE ID: CVE-2013-4465 State: PUBLISHED Published: 2013-10-25T23:00:00Z Last Updated: 2024-09-16T22:09:41.285Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/SimpleMachines/SMF2.1/issues/701 - http://download.simplemachines.org/index.php?thanks%3Bfilename=smf_2-0-6_changelog.txt - http://www.se
F2.1/issues/701 - http://download.simplemachines.org/index.php?thanks%3Bfilename=smf_2-0-6_changelog.txt - http://www.securityfocus.com/bid/63275 - http://www.openwall.com/lists/oss-security/2013/10/25/3 - http://www.openwall.com/lists/oss-security/2013/10/23/6
CVE ID: CVE-2013-4466 State: PUBLISHED Published: 2013-11-19T19:00:00Z Last Updated: 2024-09-16T20:21:16.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2013/10/25/2 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7050 - http://www.gnutls.org/security.html#GNUTLS-SA-2013-3 - http://article.gmane.org/gmane.
ncryption.gpg.gnutls.devel/7050 - http://www.gnutls.org/security.html#GNUTLS-SA-2013-3 - http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/7049
CVE ID: CVE-2013-4467 State: PUBLISHED Published: 2014-03-11T15:00:00 Last Updated: 2024-08-06T16:45:14.649Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple SQL injection vulnerabilities in the agent interface (agc/) in VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allow (1) remote attackers to execute arbitrary SQL commands via the campaign variable in SCRIPT_multirecording_AJAX.php, (2) remote authenticated users to execute arbitrary SQL commands via the server_ip parameter to manager_send.php, or (3) other unspecified vectors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Co
ctors. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2013/q4/175 - https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities - http://www.securityfocus.com/bid/63340 - http://seclists.org/oss-sec/2013/q4/171 - http://secunia.com/advisories/55453 - http://osvdb.org/98903 - http://www.exploit-db.com/exploits/29513 - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb
CVE ID: CVE-2013-4468 State: PUBLISHED Published: 2014-05-14T19:00:00 Last Updated: 2024-08-06T16:45:14.588Z Vendors: n/a Products: n/a Problem Types: n/a Description: VICIDIAL dialer (aka Asterisk GUI client) 2.8-403a, 2.7, 2.7RC1, and earlier allows remote authenticated users to execute arbitrary commands via shell metacharacters in the extension parameter in an OriginateVDRelogin action to manager_send.php. Additional Analyst Notes: - CVE Program Container: References: - https://adamcaudill.com/2013/10/23/vicidial-multiple-vulnerabilities/ - http://www.openwall.com/lists/oss-security/2013/10/23/10 - http://www.openwall.com/lists/oss-security/2013/10/25/1 - http://www.exploit-db.com/exploi
/oss-security/2013/10/23/10 - http://www.openwall.com/lists/oss-security/2013/10/25/1 - http://www.exploit-db.com/exploits/29513
CVE ID: CVE-2013-4469 State: PUBLISHED Published: 2013-11-02T18:00:00 Last Updated: 2024-08-06T16:45:14.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/nova/+bug/1206081 - http://www.open
nal Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/nova/+bug/1206081 - http://www.openwall.com/lists/oss-security/2013/10/31/3 - http://www.ubuntu.com/usn/USN-2247-1
CVE ID: CVE-2013-4470 State: PUBLISHED Published: 2013-11-04T11:00:00 Last Updated: 2024-08-06T16:45:14.830Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c. Additional Analyst Notes: -
ction in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c. Additional Analyst Notes: - CVE Program Container: References: - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b - http://www.openwall.com/lists/oss-security/2013/10/25/5 - http://www.ubuntu.com/usn/USN-2043-1 - http://www.ubuntu.com/usn/USN-2073-1 - http://www.ubuntu.com/usn/USN-2040-1 - https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.12.bz2 - http://www.ubuntu.com/usn/USN-2069-1 - http://www.ubuntu.com/usn/USN-2044-1 - http://rhn.redhat.com/errata/RHSA-2013-1801.html - http://www.ubuntu.com/usn/USN-2066-1 - http://lists.o