Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2014-6389 State: PUBLISHED Published: 2014-10-06T23:00:00 Last Updated: 2024-08-06T12:17:23.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: backup.php in PHPCompta/NOALYSS before 6.7.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the d parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.exploit-db.com/exploits/34861 - http://packetstormsecurity.com/files/128526/PHPCompta-NOALYSS-6.7.1-5638-Remote-Command-Execution.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/96791 - http://seclists.org/fulldisclosure/2014/Oct/7
CVE ID: CVE-2014-6392 State: PUBLISHED Published: 2014-09-15T14:00:00 Last Updated: 2024-08-06T12:17:22.312Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in the Facebook app 14.0 and the Facebook Messenger app 10.0 for iOS allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. NOTE: the vendor disputes the significance of this report, because the user must accept an interstitial warning before the HTML file content is rendered, and because the HTML content's origin is a sandbox domain Additional Analyst Notes: - CVE Program Container
is rendered, and because the HTML content's origin is a sandbox domain Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/fulldisclosure/2014/Sep/13
CVE ID: CVE-2014-6393 State: PUBLISHED Published: 2017-08-09T18:00:00 Last Updated: 2024-08-06T12:17:23.956Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding. Additional Analyst Notes: - CVE Program Container: References: - https://nodesecurity.io/advisories/express-no-charset-in-content-type-header - https://bugzilla.redhat.com/show_bug.cgi?id=1203190
CVE ID: CVE-2014-6394 State: PUBLISHED Published: 2014-10-08T17:00:00 Last Updated: 2024-08-06T12:17:23.629Z Vendors: n/a Products: n/a Problem Types: n/a Description: visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/62170 - http://www.openwall.com/lists/oss-security/2014/09/30/10 - https://bugzilla.redhat.com/show_bug.cgi?id=1146063 - https://nodesecurity.io/advisories/send-directory-t
014/09/30/10 - https://bugzilla.redhat.com/show_bug.cgi?id=1146063 - https://nodesecurity.io/advisories/send-directory-traversal - https://github.com/visionmedia/send/pull/59 - https://support.apple.com/HT205217 - https://github.com/visionmedia/send/commit/9c6ca9b2c0b880afd3ff91ce0d211213c5fa5f9a - http://lists.apple.com/archives/security-announce/2015/Sep/msg00002.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-October/139938.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-October/140020.html - http://www.securityfocus.com/bid/70100 - https://exchange.xforce.ibmcloud.com/vulnerabilities/96727 - http://www-01.ibm.com/support/docview.wss?uid=swg2168
100 - https://exchange.xforce.ibmcloud.com/vulnerabilities/96727 - http://www-01.ibm.com/support/docview.wss?uid=swg21687263 - http://lists.fedoraproject.org/pipermail/package-announce/2014-September/139415.html - http://www.openwall.com/lists/oss-security/2014/09/24/1
CVE ID: CVE-2014-6395 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T12:17:23.598Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - http://www.securityfocus.com/bid/71689 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ -
- http://www.securityfocus.com/bid/71689 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ettercap/ettercap/commit/e3abe7d7585ecc420a7cab73313216613aadad5a - http://www.securityfocus.com/archive/1/534248/100/0/threaded
CVE ID: CVE-2014-6396 State: PUBLISHED Published: 2014-12-19T15:00:00 Last Updated: 2024-08-06T12:17:23.943Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location. Additional Analyst Notes: - CVE Program Container: References: - https://security.gentoo.org/glsa/201505-01 - https://www.obrela.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ettercap/ettercap/commit/e3abe7d7585ecc4
a.com/home/security-labs/advisories/osi-advisory-osi-1402/ - https://github.com/Ettercap/ettercap/commit/e3abe7d7585ecc420a7cab73313216613aadad5a - http://www.securityfocus.com/bid/71697 - http://www.securityfocus.com/archive/1/534248/100/0/threaded
CVE ID: CVE-2014-6407 State: PUBLISHED Published: 2014-12-12T15:00:00 Last Updated: 2024-08-06T12:17:23.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60241 - http://secunia.com/advisories/60171 - https://docs.docker.com/v1.3/release-notes/ - http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-Decembe
pensuse-security-announce/2014-12/msg00009.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html - http://www.openwall.com/lists/oss-security/2014/11/24/5
CVE ID: CVE-2014-6408 State: PUBLISHED Published: 2014-12-12T15:00:00 Last Updated: 2024-08-06T12:17:23.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker 1.3.0 through 1.3.1 allows remote attackers to modify the default run profile of image containers and possibly bypass the container by applying unspecified security options to an image. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/60241 - http://secunia.com/advisories/60171 - https://docs.docker.com/v1.3/release-notes/ - http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00009.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145
se-security-announce/2014-12/msg00009.html - http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145154.html - http://www.openwall.com/lists/oss-security/2014/11/24/5
CVE ID: CVE-2014-6409 State: PUBLISHED Published: 2014-10-06T23:00:00 Last Updated: 2024-08-06T12:17:22.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in M/Monit 3.3.2 and earlier allows remote attackers to hijack the authentication of administrators for requests that change user passwords via the fullname and password parameters to /admin/users/update. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/96122 - http://seclists.org/fulldisclosure/2014/Sep/71 - http://www.exploit-db.com/exploits/34718 - http://packetstormsecurity.com/files/128321/M-Monit-3.2.2-Cro
e/2014/Sep/71 - http://www.exploit-db.com/exploits/34718 - http://packetstormsecurity.com/files/128321/M-Monit-3.2.2-Cross-Site-Request-Forgery.html
CVE ID: CVE-2014-6410 State: PUBLISHED Published: 2014-09-28T10:00:00 Last Updated: 2024-08-06T12:17:23.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2377-1 - http://rhn.redhat.com/errata/RHSA-2014-1318.html - http://marc.info/?l=bugtraq&m=142722450701342&w=2 - http://www.ubuntu.com/usn/USN-2375-1 - h
rrata/RHSA-2014-1318.html - http://marc.info/?l=bugtraq&m=142722450701342&w=2 - http://www.ubuntu.com/usn/USN-2375-1 - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - http://www.openwall.com/lists/oss-security/2014/09/15/9 - http://marc.info/?l=bugtraq&m=142722544401658&w=2 - http://www.securityfocus.com/bid/69799 - http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - http://www.ubuntu.com/usn/USN-2378-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c03aa9f6e1f938618e6db2e23afef0574efeeb65 - http://www.ubuntu.com/usn/USN-2374-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1141809 - https://github.com/to
b65 - http://www.ubuntu.com/usn/USN-2374-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1141809 - https://github.com/torvalds/linux/commit/c03aa9f6e1f938618e6db2e23afef0574efeeb65 - http://www.ubuntu.com/usn/USN-2379-1 - http://www.ubuntu.com/usn/USN-2376-1
CVE ID: CVE-2014-6412 State: PUBLISHED Published: 2018-04-12T21:00:00 Last Updated: 2024-08-06T12:17:23.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: WordPress before 4.4 makes it easier for remote attackers to predict password-recovery tokens via a brute-force approach. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/130380/WordPress-Failed-Randomness.html - https://core.trac.wordpress.org/ticket/28633 - http://seclists.org/fulldisclosure/2015/Feb/53 - http://www.securityfocus.com/bid/72589 - http://seclists.org/fulldisclosure/2015/Feb/42 - http://www.securitytracker.com/id/1031749 - https://bugzilla.redhat.com/show_bug
clists.org/fulldisclosure/2015/Feb/42 - http://www.securitytracker.com/id/1031749 - https://bugzilla.redhat.com/show_bug.cgi?id=1192474
CVE ID: CVE-2014-6413 State: PUBLISHED Published: 2020-02-07T15:47:52 Last Updated: 2024-08-06T12:17:23.785Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site Scripting (XSS) vulnerability exists in WatchGuard XTM 11.8.3 via the poll_name parameter in the firewall/policy script. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/69958 - https://exchange.xforce.ibmcloud.com/vulnerabilities/96069 - http://seclists.org/fulldisclosure/2014/Sep/70 - https://packetstormsecurity.com/files/128310
CVE ID: CVE-2014-6414 State: PUBLISHED Published: 2014-10-02T14:00:00 Last Updated: 2024-08-06T12:17:24.116Z Vendors: n/a Products: n/a Problem Types: n/a Description: OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2 allows remote authenticated users to set admin network attributes to default values via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.launchpad.net/neutron/+bug/1357379 - http://www.openwall.com/lists/oss-security/2014/09/15/5 - http://rhn.redhat.com/errata/RHSA-2014-1686.html - http://rhn.redhat.com/errata/RHSA-2014-1786.html - http://rhn.redhat.com/errata/RHSA-2014-1785.html - http://www.ubuntu.com/usn/USN-2408-1
com/errata/RHSA-2014-1786.html - http://rhn.redhat.com/errata/RHSA-2014-1785.html - http://www.ubuntu.com/usn/USN-2408-1 - http://secunia.com/advisories/62299
CVE ID: CVE-2014-6416 State: PUBLISHED Published: 2014-09-28T10:00:00 Last Updated: 2024-08-06T12:17:23.391Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2377-1 - http://www.securityfocus.com/bid/69805 - https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://www.openwall.com/lists/oss-security/2014/09/15
m/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://www.openwall.com/lists/oss-security/2014/09/15/7 - https://bugzilla.redhat.com/show_bug.cgi?id=1142060 - http://www.ubuntu.com/usn/USN-2378-1 - http://tracker.ceph.com/issues/8979 - http://www.ubuntu.com/usn/USN-2379-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3 - http://www.ubuntu.com/usn/USN-2376-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
CVE ID: CVE-2014-6417 State: PUBLISHED Published: 2014-09-28T10:00:00 Last Updated: 2024-08-06T12:17:23.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2377-1 - https://bugzilla.redhat.com/show_bug.cgi?id=1142072 - https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http:
.com/show_bug.cgi?id=1142072 - https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://www.openwall.com/lists/oss-security/2014/09/15/7 - http://www.ubuntu.com/usn/USN-2378-1 - http://tracker.ceph.com/issues/9560 - http://tracker.ceph.com/issues/8979 - http://www.ubuntu.com/usn/USN-2379-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3 - http://www.ubuntu.com/usn/USN-2376-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
CVE ID: CVE-2014-6418 State: PUBLISHED Published: 2014-09-28T10:00:00 Last Updated: 2024-08-06T12:17:23.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly validate auth replies, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via crafted data from the IP address of a Ceph Monitor. Additional Analyst Notes: - CVE Program Container: References: - http://www.ubuntu.com/usn/USN-2377-1 - https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://www.openwall.com/lists/oss-security/2014/09/15/7 - htt
ds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://www.openwall.com/lists/oss-security/2014/09/15/7 - http://www.ubuntu.com/usn/USN-2378-1 - http://tracker.ceph.com/issues/8979 - http://www.ubuntu.com/usn/USN-2379-1 - http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3 - http://www.ubuntu.com/usn/USN-2376-1 - http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8 - http://tracker.ceph.com/issues/9561 - https://bugzilla.redhat.com/show_bug.cgi?id=1142073
CVE ID: CVE-2014-6420 State: PUBLISHED Published: 2019-12-27T20:43:44 Last Updated: 2024-08-06T12:17:23.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in Livefyre LiveComments 3.0 allows remote attackers to inject arbitrary web script or HTML via the name of an uploaded picture. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/128293/Livefyre-LiveComments-3.0-Cross-Site-Scripting.html - https://exchange.xforce.ibmcloud.com/vulnerabilities/96037
CVE ID: CVE-2014-6421 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.735Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the SDP dissector in Wireshark 1.10.x before 1.10.10 allows remote attackers to cause a denial of service (application crash) via a crafted packet that leverages split memory ownership between the SDP and RTP dissectors. Additional Analyst Notes: - CVE Program Container: References: - http://linux.oracle.com/errata/ELSA-2014-1676 - http://secunia.com/advisories/61933 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn
ists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9920 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=04c05a21e34cec326f1aff2f5f8a6e74e1ced984 - http://secunia.com/advisories/60280 - http://linux.oracle.com/errata/ELSA-2014-1677 - http://www.wireshark.org/security/wnpa-sec-2014-12.html - http://secunia.com/advisories/61929
CVE ID: CVE-2014-6422 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.887Z Vendors: n/a Products: n/a Problem Types: n/a Description: The SDP dissector in Wireshark 1.10.x before 1.10.10 creates duplicate hashtables for a media channel, which allows remote attackers to cause a denial of service (application crash) via a crafted packet to the RTP dissector. Additional Analyst Notes: - CVE Program Container: References: - http://linux.oracle.com/errata/ELSA-2014-1676 - http://secunia.com/advisories/61933 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/errata/RHSA-2014
pdates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9920 - http://www.debian.org/security/2014/dsa-3049 - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=04c05a21e34cec326f1aff2f5f8a6e74e1ced984 - http://secunia.com/advisories/60280 - http://secunia.com/advisories/60578 - http://linux.oracle.com/errata/ELSA-2014-1677 - http://www.wireshark.org/security/wnpa-sec-2014-12.html - http://secunia.com/advisories/61929
CVE ID: CVE-2014-6423 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tvb_raw_text_add function in epan/dissectors/packet-megaco.c in the MEGACO dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 allows remote attackers to cause a denial of service (infinite loop) via an empty line. Additional Analyst Notes: - CVE Program Container: References: - http://linux.oracle.com/errata/ELSA-2014-1676 - http://secunia.com/advisories/61933 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/erra
g/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - http://www.debian.org/security/2014/dsa-3049 - http://www.wireshark.org/security/wnpa-sec-2014-13.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://secunia.com/advisories/60280 - http://secunia.com/advisories/60578 - http://linux.oracle.com/errata/ELSA-2014-1677 - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=9112a099d7cc2cd924b7c667bf27f6e112b970c6 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10333 - http://secunia.com/advisories/61929
CVE ID: CVE-2014-6424 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_v9_v10_pdu_data function in epan/dissectors/packet-netflow.c in the Netflow dissector in Wireshark 1.10.x before 1.10.10 and 1.12.x before 1.12.1 refers to incorrect offset and start variables, which allows remote attackers to cause a denial of service (uninitialized memory read and application crash) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://linux.oracle.com/errata/ELSA-2014-1676 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redh
ux.oracle.com/errata/ELSA-2014-1676 - http://lists.opensuse.org/opensuse-updates/2014-09/msg00058.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=44698259b1f5865c60323acaf2a633654a2abe81 - http://www.debian.org/security/2014/dsa-3049 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10370 - http://www.wireshark.org/security/wnpa-sec-2014-14.html - http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00033.html - http://secunia.com/advisories/60280 - http://secunia.com/advisories/60578 - http://secunia.com/advisories/61929
CVE ID: CVE-2014-6425 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The (1) get_quoted_string and (2) get_unquoted_string functions in epan/dissectors/packet-cups.c in the CUPS dissector in Wireshark 1.12.x before 1.12.1 allow remote attackers to cause a denial of service (buffer over-read and application crash) via a CUPS packet that lacks a trailing '\0' character. Additional Analyst Notes: - CVE Program Container: References: - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=c10396dbbf782a576bc1f9a931cf86090cec3878 - http://linux.oracle.com/errata/ELSA-2014-1676 - ht
reshark.git%3Ba=commit%3Bh=c10396dbbf782a576bc1f9a931cf86090cec3878 - http://linux.oracle.com/errata/ELSA-2014-1676 - http://secunia.com/advisories/61933 - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=10353 - http://rhn.redhat.com/errata/RHSA-2014-1677.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - http://secunia.com/advisories/60280 - http://www.wireshark.org/security/wnpa-sec-2014-15.html - http://linux.oracle.com/errata/ELSA-2014-1677 - http://secunia.com/advisories/61929
CVE ID: CVE-2014-6426 State: PUBLISHED Published: 2014-09-20T10:00:00 Last Updated: 2024-08-06T12:17:23.433Z Vendors: n/a Products: n/a Problem Types: n/a Description: The dissect_hip_tlv function in epan/dissectors/packet-hip.c in the HIP dissector in Wireshark 1.12.x before 1.12.1 does not properly handle a NULL tree, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet. Additional Analyst Notes: - CVE Program Container: References: - http://linux.oracle.com/errata/ELSA-2014-1676 - http://www.wireshark.org/security/wnpa-sec-2014-16.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3B
16.html - http://rhn.redhat.com/errata/RHSA-2014-1676.html - https://code.wireshark.org/review/gitweb?p=wireshark.git%3Ba=commit%3Bh=d9e5021fe79973d00ddd8fcef0bbefbaae63dd0f - http://secunia.com/advisories/60280 - http://secunia.com/advisories/61929