Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2012-3357 State: PUBLISHED Published: 2012-07-22T16:00:00 Last Updated: 2024-08-06T20:05:12.106Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SVN revision view (lib/vclib/svn/svn_repos.py) in ViewVC before 1.1.15 does not properly handle log messages when a readable path is copied from an unreadable path, which allows remote attackers to obtain sensitive information, related to a "log msg leak." Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/06/25/8 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76615 - http://www.securityfocus.com/bid/54199 - https://lwn.net/Articles/505096/ - https://wik
loud.com/vulnerabilities/76615 - http://www.securityfocus.com/bid/54199 - https://lwn.net/Articles/505096/ - https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0175 - http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2758 - http://osvdb.org/83227 - http://www.mandriva.com/security/advisories?name=MDVSA-2013:134 - http://www.debian.org/security/2012/dsa-2563
CVE ID: CVE-2012-3358 State: PUBLISHED Published: 2012-07-18T23:00:00 Last Updated: 2024-08-06T20:05:12.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple heap-based buffer overflows in the j2k_read_sot function in j2k.c in OpenJPEG 1.5 allow remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted (1) tile number or (2) tile length in a JPEG 2000 image file. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/76850 - http://www.securityfocus.com/bid/54373 - http://code.google.com/p/openjpeg/source/detail?r=1727 - http://rhn.redhat.com/errata/RHSA
securityfocus.com/bid/54373 - http://code.google.com/p/openjpeg/source/detail?r=1727 - http://rhn.redhat.com/errata/RHSA-2012-1068.html - http://secunia.com/advisories/49913 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:104 - http://www.openwall.com/lists/oss-security/2012/07/11/1 - http://osvdb.org/83741
CVE ID: CVE-2012-3359 State: PUBLISHED Published: 2014-03-30T00:00:00 Last Updated: 2024-08-06T20:05:12.449Z Vendors: n/a Products: n/a Problem Types: n/a Description: Luci in Red Hat Conga stores the user's username and password in a Base64 encoded string in the __ac session cookie, which allows attackers to gain privileges by accessing this cookie. NOTE: this issue has been SPLIT due to different vulnerability types. Use CVE-2013-7347 for the incorrect enforcement of a user timeout. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=607179 - http://rhn.redhat.com/errata/RHSA-2013-0128.html
CVE ID: CVE-2012-3360 State: PUBLISHED Published: 2012-07-22T16:00:00 Last Updated: 2024-08-06T20:05:12.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54277 - http://secunia.com/advisories/49763 - https://bugs.launchpad.net/nova/+bug/1015531 - http://secunia.com/advisories/49802 - https:
cunia.com/advisories/49763 - https://bugs.launchpad.net/nova/+bug/1015531 - http://secunia.com/advisories/49802 - https://lists.launchpad.net/openstack/msg14089.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html - https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 - https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 - http://www.ubuntu.com/usn/USN-1497-1
CVE ID: CVE-2012-3361 State: PUBLISHED Published: 2012-07-22T16:00:00 Last Updated: 2024-08-06T20:05:12.062Z Vendors: n/a Products: n/a Problem Types: n/a Description: virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/49763 - https://review.openstack.org/#/c/9268/ - http://www.securityfocus.com/bid/54278 - https://bugs.launchpad.net/nova/+bug/1015531 - http://secunia.com/advisories/49802 - http://lists.fedoraproject.org/pipermail/package-announce
.net/nova/+bug/1015531 - http://secunia.com/advisories/49802 - http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083969.html - https://lists.launchpad.net/openstack/msg14089.html - http://lists.fedoraproject.org/pipermail/package-announce/2012-July/083984.html - https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 - https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 - http://www.ubuntu.com/usn/USN-1497-1
CVE ID: CVE-2012-3362 State: PUBLISHED Published: 2012-07-12T20:00:00 Last Updated: 2024-08-06T20:05:11.734Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in eXtplorer 2.1 RC3 and earlier allows remote attackers to hijack the authentication of administrators for requests that add an administrator account via an adduser admin action. Additional Analyst Notes: - CVE Program Container: References: - http://www.autosectools.com/Advisories/eXtplorer.2.1.RC3_Cross-site.Request.Forgery_174.html - http://www.debian.org/security/2012/dsa-2510 - http://www.openwall.com/lists/oss-security/2012/06/25/1 - http://www.openwall.com/lists/oss-secur
curity/2012/dsa-2510 - http://www.openwall.com/lists/oss-security/2012/06/25/1 - http://www.openwall.com/lists/oss-security/2012/06/24/1 - http://www.openwall.com/lists/oss-security/2012/06/26/1 - http://www.openwall.com/lists/oss-security/2012/06/27/1
CVE ID: CVE-2012-3363 State: PUBLISHED Published: 2013-02-13T17:00:00 Last Updated: 2025-01-16T20:38:41.614Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0 does not properly handle SimpleXMLElement classes, which allows remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://moodle.org/mod/forum/discuss.php?d=225345 - http://lists.fedoraproject.org/pipermail/package-announce
erences: - https://moodle.org/mod/forum/discuss.php?d=225345 - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101358.html - http://www.openwall.com/lists/oss-security/2012/06/27/2 - http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34284 - http://www.debian.org/security/2012/dsa-2505 - http://www.openwall.com/lists/oss-security/2012/06/26/4 - http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101310.html - http://www.openwall.com/lists/oss-security/2012/06/26/2 - http://openwall.com/lists/oss-security/2013/03/25/2 - http://www.securitytracker.com/id?1027208 - http://framework.zend.com/security/advisory/ZF2012-01 - https://www.sec-co
- http://www.securitytracker.com/id?1027208 - http://framework.zend.com/security/advisory/ZF2012-01 - https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
CVE ID: CVE-2012-3364 State: PUBLISHED Published: 2013-01-22T23:00:00Z Last Updated: 2024-08-06T20:05:12.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple stack-based buffer overflows in the Near Field Communication Controller Interface (NCI) in the Linux kernel before 3.4.5 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via incoming frames with crafted length fields. Additional Analyst Notes: - CVE Program Container: References: - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.5 - http://www.openwall.com/lists/oss-security/2012/06/27/9 - https://github.com/torvalds/linux/commit/67de956ff5dc1d4f321e16cfbd63f5b
.openwall.com/lists/oss-security/2012/06/27/9 - https://github.com/torvalds/linux/commit/67de956ff5dc1d4f321e16cfbd63f5be3b691b43 - http://ubuntu.com/usn/usn-1529-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=67de956ff5dc1d4f321e16cfbd63f5be3b691b43 - http://marc.info/?l=linux-kernel&m=134030878917784&w=2
CVE ID: CVE-2012-3365 State: PUBLISHED Published: 2012-07-20T10:00:00 Last Updated: 2024-08-06T20:05:12.169Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SQLite functionality in PHP before 5.3.15 allows remote attackers to bypass the open_basedir protection mechanism via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1027286 - https://hermes.opensuse.org/messages/15376003 - http://secunia.com/advisories/51178 - http://www.securityfocus.com/bid/54612 - http://secunia.com/advisories/49969 - http://www.php.net/ChangeLog-5.php - http://osvdb.org/84100 - http://lists.opensuse.org/opensuse-security-announce/
69 - http://www.php.net/ChangeLog-5.php - http://osvdb.org/84100 - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00022.html - http://www.mandriva.com/security/advisories?name=MDVSA-2012:108 - http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00021.html
CVE ID: CVE-2012-3366 State: PUBLISHED Published: 2012-07-03T16:00:00 Last Updated: 2024-08-06T20:05:12.537Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Trigger plugin in bcfg2 1.2.x before 1.2.3 allows remote attackers with root access to the client to execute arbitrary commands via shell metacharacters in the UUID field to the server process (bcfg2-server). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Bcfg2/bcfg2/commit/a524967e8d5c4c22e49cd619aed20c87a316c0be - http://www.debian.org/security/2012/dsa-2503 - http://secunia.com/advisories/49690 - http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539 - http://www.securityfoc
/secunia.com/advisories/49690 - http://permalink.gmane.org/gmane.comp.sysutils.bcfg2.devel/4539 - http://www.securityfocus.com/bid/54217 - http://secunia.com/advisories/49629 - https://exchange.xforce.ibmcloud.com/vulnerabilities/76616
CVE ID: CVE-2012-3367 State: PUBLISHED Published: 2012-08-13T20:00:00 Last Updated: 2024-08-06T20:05:12.335Z Vendors: n/a Products: n/a Problem Types: n/a Description: Red Hat Certificate System (RHCS) before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority (CA) certificate. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=836268 - http://www.securitytracker.com/id?1027284 - http://osvdb.org/84098 - http://secunia.com/advisories/50013 - https:/
268 - http://www.securitytracker.com/id?1027284 - http://osvdb.org/84098 - http://secunia.com/advisories/50013 - https://fedorahosted.org/pki/changeset/2430 - https://exchange.xforce.ibmcloud.com/vulnerabilities/77102 - http://www.securityfocus.com/bid/54608 - http://rhn.redhat.com/errata/RHSA-2012-1103.html
CVE ID: CVE-2012-3368 State: PUBLISHED Published: 2012-07-03T21:00:00Z Last Updated: 2024-08-06T20:05:12.394Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer signedness error in attach.c in dtach 0.8 allows remote attackers to obtain sensitive information from daemon stack memory in opportunistic circumstances by reading application data after an improper connection-close request, as demonstrated by running an IRC client in dtach. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=812551 - http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812 - http://bugs.debian.org/cgi-b
ourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625302 - https://bugzilla.redhat.com/show_bug.cgi?id=835849 - http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357
CVE ID: CVE-2012-3369 State: PUBLISHED Published: 2013-02-05T23:11:00 Last Updated: 2024-08-06T20:05:11.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's password to be used. Additional Analyst Notes: - CVE Program Container: References: - http://rhn.redhat.com/errata/RHSA-2013-0192.html - http://rhn.redhat.com/errata/RHSA-2013-0198.html - http://rhn.redhat.com/errata/RHSA-2013-0195.
ta/RHSA-2013-0192.html - http://rhn.redhat.com/errata/RHSA-2013-0198.html - http://rhn.redhat.com/errata/RHSA-2013-0195.html - http://rhn.redhat.com/errata/RHSA-2013-0221.html - http://rhn.redhat.com/errata/RHSA-2013-0196.html - http://rhn.redhat.com/errata/RHSA-2013-0193.html - http://secunia.com/advisories/51984 - https://bugzilla.redhat.com/show_bug.cgi?id=836451 - http://securitytracker.com/id?1028042 - http://secunia.com/advisories/52054 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81512 - http://rhn.redhat.com/errata/RHSA-2013-0191.html - http://rhn.redhat.com/errata/RHSA-2013-0533.html - http://rhn.redhat.com/errata/RHSA-2013-0197.html - http://www.securityfocus.com/bid/5754
om/errata/RHSA-2013-0533.html - http://rhn.redhat.com/errata/RHSA-2013-0197.html - http://www.securityfocus.com/bid/57547 - http://rhn.redhat.com/errata/RHSA-2013-0194.html
CVE ID: CVE-2012-3370 State: PUBLISHED Published: 2013-02-05T23:11:00 Last Updated: 2024-08-06T20:05:12.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remote attackers to gain privileges as other users. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=836456 - https://exchange.xforce.ibmcloud.com/vulnerabilities/8151
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=836456 - https://exchange.xforce.ibmcloud.com/vulnerabilities/81513 - http://rhn.redhat.com/errata/RHSA-2013-0192.html - http://rhn.redhat.com/errata/RHSA-2013-0198.html - http://rhn.redhat.com/errata/RHSA-2013-0195.html - http://rhn.redhat.com/errata/RHSA-2013-0221.html - http://www.osvdb.org/89581 - http://rhn.redhat.com/errata/RHSA-2013-0196.html - http://www.securityfocus.com/bid/57550 - http://rhn.redhat.com/errata/RHSA-2013-0193.html - http://secunia.com/advisories/51984 - http://securitytracker.com/id?1028042 - http://secunia.com/advisories/52054 - http://rhn.redhat.com/errata/RHSA-2013-0191.html - http://rhn.redhat.com/errata/RHSA
tp://secunia.com/advisories/52054 - http://rhn.redhat.com/errata/RHSA-2013-0191.html - http://rhn.redhat.com/errata/RHSA-2013-0533.html - http://rhn.redhat.com/errata/RHSA-2013-0197.html - http://rhn.redhat.com/errata/RHSA-2013-0194.html
CVE ID: CVE-2012-3371 State: PUBLISHED Published: 2012-07-17T21:00:00 Last Updated: 2024-08-06T20:05:12.113Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/54388 - https://lists.launchpad.net/openstack/msg14452.html - https://bugs.launchpad.net/nova/+bug/1017795 - ht
.com/bid/54388 - https://lists.launchpad.net/openstack/msg14452.html - https://bugs.launchpad.net/nova/+bug/1017795 - http://www.openwall.com/lists/oss-security/2012/07/11/13 - http://www.ubuntu.com/usn/USN-1501-1 - https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d
CVE ID: CVE-2012-3372 State: PUBLISHED Published: 2012-07-09T10:00:00.000Z Last Updated: 2025-01-27T21:07:51.463Z Vendors: n/a Products: n/a Problem Types: n/a Description: The default configuration of Cyberoam UTM appliances uses the same Certification Authority certificate and same private key across different customers' installations, which makes it easier for man-in-the-middle attackers to spoof SSL servers by leveraging the presence of the Cyberoam_SSL_CA certificate in a list of trusted root certification authorities. NOTE: the vendor disputes the significance of this issue because the appliance "does not allow import or export of the foresaid private key. Additional Analyst Notes: - C
issue because the appliance "does not allow import or export of the foresaid private key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://media.torproject.org/misc/2012-07-03-cyberoam-CVE-2012-3372.txt - http://www.theregister.co.uk/2012/07/07/cyberoam_tor_ssl_spying_flap/ - https://blog.torproject.org/blog/security-vulnerability-found-cyberoam-dpi-devices-cve-2012-3372 - http://archives.neohapsis.com/archives/bugtraq/2012-07/0021.html - http://blog.cyberoam.com/2012/07/ssl-bridging-cyberoam-approach/
CVE ID: CVE-2012-3373 State: PUBLISHED Published: 2012-09-19T19:00:00 Last Updated: 2024-08-06T20:05:11.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Apache Wicket 1.4.x before 1.4.21 and 1.5.x before 1.5.8 allows remote attackers to inject arbitrary web script or HTML via vectors involving a %00 sequence in an Ajax link URL associated with a Wicket app. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/55445 - http://secunia.com/advisories/50555 - https://exchange.xforce.ibmcloud.com/vulnerabilities/78321 - http://wicket.apache.org/2012/09/06/cve-2012-3373.html - http://osvdb.org/85
xforce.ibmcloud.com/vulnerabilities/78321 - http://wicket.apache.org/2012/09/06/cve-2012-3373.html - http://osvdb.org/85249 - http://www.securitytracker.com/id?1027508
CVE ID: CVE-2012-3374 State: PUBLISHED Published: 2012-07-07T10:00:00 Last Updated: 2024-08-06T20:05:12.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in markup.c in the MXit protocol plugin in libpurple in Pidgin before 2.10.5 allows remote attackers to execute arbitrary code via a crafted inline image in a message. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2012-07/msg00009.html - http://www.pidgin.im/news/security/index.php?id=64 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17678 - http://secunia.com/advisories/50005 - http://www.mandriva.
itory/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17678 - http://secunia.com/advisories/50005 - http://www.mandriva.com/security/advisories?name=MDVSA-2012:105 - http://rhn.redhat.com/errata/RHSA-2012-1102.html - http://hg.pidgin.im/pidgin/main/rev/ded93865ef42
CVE ID: CVE-2012-3375 State: PUBLISHED Published: 2012-10-03T10:00:00 Last Updated: 2024-08-06T20:05:12.564Z Vendors: n/a Products: n/a Problem Types: n/a Description: The epoll_ctl system call in fs/eventpoll.c in the Linux kernel before 3.2.24 does not properly handle ELOOP errors in EPOLL_CTL_ADD operations, which allows local users to cause a denial of service (file-descriptor consumption and system crash) via a crafted application that attempts to create a circular epoll dependency. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1083. Additional Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/100165733 - http:/
al Analyst Notes: - CVE Program Container: References: - https://downloads.avaya.com/css/P8/documents/100165733 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.24 - http://www.securitytracker.com/id?1027237 - https://github.com/torvalds/linux/commit/13d518074a952d33d47c428419693f63389547e9 - http://secunia.com/advisories/51164 - http://www.openwall.com/lists/oss-security/2012/07/04/2 - http://ubuntu.com/usn/usn-1529-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=13d518074a952d33d47c428419693f63389547e9 - https://bugzilla.redhat.com/show_bug.cgi?id=837502
CVE ID: CVE-2012-3376 State: PUBLISHED Published: 2012-07-12T19:00:00 Last Updated: 2024-08-06T20:05:12.540Z Vendors: n/a Products: n/a Problem Types: n/a Description: DataNodes in Apache Hadoop 2.0.0 alpha does not check the BlockTokens of clients when Kerberos is enabled and the DataNode has checked out the same BlockPool twice from a NodeName, which might allow remote clients to read arbitrary blocks, write to blocks to which they only have read access, and have other unspecified impacts. Additional Analyst Notes: - CVE Program Container: References: - https://www.cloudera.com/documentation/other/security-bulletins/topics/csb_topic_1.html - http://archives.neohapsis.com/archives/bugtraq/2
ra.com/documentation/other/security-bulletins/topics/csb_topic_1.html - http://archives.neohapsis.com/archives/bugtraq/2012-07/0049.html - http://www.securityfocus.com/bid/54358
CVE ID: CVE-2012-3377 State: PUBLISHED Published: 2012-07-12T21:00:00 Last Updated: 2024-08-06T20:05:12.049Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the Ogg_DecodePacket function in the OGG demuxer (modules/demux/ogg.c) in VideoLAN VLC media player before 2.0.2 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted OGG file. Additional Analyst Notes: - CVE Program Container: References: - http://www.openwall.com/lists/oss-security/2012/07/06/2 - http://www.securitytracker.com/id?1027224 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15
curitytracker.com/id?1027224 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15299 - http://secunia.com/advisories/49835 - http://www.securityfocus.com/bid/54345 - http://www.openwall.com/lists/oss-security/2012/07/06/1 - http://git.videolan.org/?p=vlc/vlc-2.0.git%3Ba=commitdiff%3Bh=16e9e126333fb7acb47d363366fee3deadc8331e
CVE ID: CVE-2012-3378 State: PUBLISHED Published: 2012-08-31T18:00:00Z Last Updated: 2024-08-06T20:05:12.573Z Vendors: n/a Products: n/a Problem Types: n/a Description: The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the random number generator and generates predictable temporary file names, which makes it easier for local users to create or truncate files via a symlink attack on a temporary socket file in /tmp/at-spi2. Additional Analyst Notes: - CVE Program Container: References: - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=678026 - http://www.openwall.com/lists/oss-security/2012/07/05/1 - https://bugzilla.gnome.org/show_bug.cgi?id=6
.cgi?bug=678026 - http://www.openwall.com/lists/oss-security/2012/07/05/1 - https://bugzilla.gnome.org/show_bug.cgi?id=678348 - http://www.openwall.com/lists/oss-security/2012/07/06/3
CVE ID: CVE-2012-3379 State: REJECTED Published: 2012-08-31T18:00:00Z Last Updated: 2024-09-16T17:28:56.766Z Description: No description available.