Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2018-12237 State: PUBLISHED Published: 2019-01-24T21:00:00Z Last Updated: 2024-09-16T16:28:04.698Z Vendors: Symantec Corporation Products: Symantec Reporter Problem Types: OS command injection Description: The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1465.html - http://www.securityfocus.com/bid/106518
CVE ID: CVE-2018-12238 State: PUBLISHED Published: 2018-11-29T14:00:00 Last Updated: 2024-08-05T08:30:58.948Z Vendors: Symantec Corporation Products: Norton; Symantec Endpoint Protection (SEP); Symantec Endpoint Protection Small Business Edition (SEP SBE); Symantec Endpoint Protection Cloud (SEP Cloud) Problem Types: AV Bypass Description: Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud (SEP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent
EP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105917 - https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html
CVE ID: CVE-2018-12239 State: PUBLISHED Published: 2018-11-29T14:00:00 Last Updated: 2024-08-05T08:30:59.652Z Vendors: Symantec Corporation Products: Norton; Symantec Endpoint Protection (SEP); Symantec Endpoint Protection Small Business Edition (SEP SBE); Symantec Endpoint Protection Cloud (SEP Cloud) Problem Types: AV Bypass Description: Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition (SEP SBE) prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud (SEP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent
EP Cloud) prior to 22.15.1 may be susceptible to an AV bypass issue, which is a type of exploit that works to circumvent one of the virus detection engines to avoid a specific type of virus protection. One of the antivirus engines depends on a signature pattern from a database to identify malicious files and viruses; the antivirus bypass exploit looks to alter the file being scanned so it is not detected. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105918 - https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html
CVE ID: CVE-2018-12240 State: PUBLISHED Published: 2018-08-29T20:00:00Z Last Updated: 2024-09-16T23:31:48.124Z Vendors: Symantec Corporation Products: Norton Identity Safe for Android Problem Types: Privilege Escalation Description: The Norton Identity Safe product prior to 5.3.0.976 may be susceptible to a privilege escalation issue via a hard coded IV, which is a type of vulnerability that can potentially increase the likelihood of encrypted data being recovered without adequate credentials. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105146 - https://support.symantec.com/en_US/article.SYMSA1460.html
CVE ID: CVE-2018-12241 State: PUBLISHED Published: 2018-11-27T18:00:00 Last Updated: 2024-08-05T08:30:58.999Z Vendors: Symantec Corporation Products: Symantec Security Analytics (SA) Problem Types: Cross-site scripting Description: The Symantec Security Analytics (SA) 7.x prior to 7.3.4 Web UI is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker with knowledge of the SA web UI hostname or IP address can craft a malicious URL for the SA web UI and target SA web UI users with phishing attacks or other social engineering techniques. A successful attack allows injecting malicious JavaScript code into the SA web UI client application. Additional Analyst Notes:
ssful attack allows injecting malicious JavaScript code into the SA web UI client application. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1466.html - http://www.securityfocus.com/bid/105965
CVE ID: CVE-2018-12242 State: PUBLISHED Published: 2018-09-19T15:00:00Z Last Updated: 2024-09-16T18:55:16.447Z Vendors: Symantec Corporation Products: Symantec Messaging Gateway Problem Types: Authentication bypass Description: The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to an authentication bypass exploit, which is a type of issue that can allow attackers to potentially circumvent security mechanisms currently in place and gain access to the system or network. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1461.html - http://www.securityfocus.com/bid/105329
CVE ID: CVE-2018-12243 State: PUBLISHED Published: 2018-09-19T15:00:00Z Last Updated: 2024-09-16T20:21:44.540Z Vendors: Symantec Corporation Products: Symantec Messaging Gateway Problem Types: XXE Description: The Symantec Messaging Gateway product prior to 10.6.6 may be susceptible to a XML external entity (XXE) exploit, which is a type of issue where XML input containing a reference to an external entity is processed by a weakly configured XML parser. The attack uses file URI schemes or relative paths in the system identifier to access files that should not normally be accessible. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SY
cessible. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1461.html - http://www.securityfocus.com/bid/105330
CVE ID: CVE-2018-12244 State: PUBLISHED Published: 2019-04-25T18:49:02 Last Updated: 2024-08-05T08:30:59.637Z Vendors: Symantec Corporation Products: Symantec Endpoint Protection (Mac Client) Problem Types: CSV/DDE Injection Description: SEP (Mac client) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a CSV/DDE injection (also known as formula injection) vulnerability, which is a type of issue whereby an application or website allows untrusted input into CSV files. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/en_US/article.SYMSA1479.html - https://www.securityfocus.com/bid/107999
CVE ID: CVE-2018-12245 State: PUBLISHED Published: 2018-11-29T14:00:00 Last Updated: 2024-08-05T08:30:59.056Z Vendors: Symantec Corporation Products: Symantec Endpoint Protection (SEP) Problem Types: DLL Preloading Description: Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an application being installed unintentionally loads a DLL provided by a potential attacker. Note that this particular type of exploit only manifests at install time; no remediation is required for software that has already been installed. This issue only impacted the Trialware media for Symantec Endpoint Protection, w
ftware that has already been installed. This issue only impacted the Trialware media for Symantec Endpoint Protection, which has since been updated. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/105919 - https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1468.html
CVE ID: CVE-2018-12246 State: PUBLISHED Published: 2018-10-22T19:00:00Z Last Updated: 2024-09-16T22:31:26.952Z Vendors: Symantec Corporation Products: Symantec Web Isolation Problem Types: Cross-site scripting (XSS) Description: Symantec Web Isolation (WI) 1.11 prior to 1.11.21 is susceptible to a reflected cross-site scripting (XSS) vulnerability. A remote attacker can target end users protected by WI with social engineering attacks using crafted URLs for legitimate web sites. A successful attack allows injecting malicious JavaScript code into the website's rendered copy running inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website
unning inside the end user's web browser. It does not allow injecting code into the real (isolated) copy of the website running on the WI Threat Isolation Engine. Additional Analyst Notes: - CVE Program Container: References: - https://support.symantec.com/content/unifiedweb/en_US/article.SYMSA1464.html - http://www.securityfocus.com/bid/105581
CVE ID: CVE-2018-12247 State: PUBLISHED Published: 2018-06-12T14:00:00Z Last Updated: 2024-09-16T20:03:15.672Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class, related to certain .clone usage, because mrb_obj_clone in kernel.c copies flags other than the MRB_FLAG_IS_FROZEN flag (e.g., the embedded flag). Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4036 - https://github.com/mruby/mruby/commit/55edae0226409de25e59922807cb09acb45731a2
CVE ID: CVE-2018-12248 State: PUBLISHED Published: 2018-06-12T14:00:00Z Last Updated: 2024-09-16T16:43:26.889Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mruby 1.4.1. There is a heap-based buffer over-read associated with OP_ENTER because mrbgems/mruby-fiber/src/fiber.c does not extend the stack in cases of many arguments to fiber. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4038 - https://github.com/mruby/mruby/commit/778500563a9f7ceba996937dc886bd8cde29b42b
CVE ID: CVE-2018-12249 State: PUBLISHED Published: 2018-06-12T14:00:00 Last Updated: 2024-08-05T08:30:59.698Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in mruby 1.4.1. There is a NULL pointer dereference in mrb_class_real because "class BasicObject" is not properly supported in class.c. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/issues/4037 - https://github.com/mruby/mruby/commit/faa4eaf6803bd11669bc324b4c34e7162286bfa3 - https://lists.debian.org/debian-lts-announce/2022/05/msg00006.html
CVE ID: CVE-2018-12250 State: PUBLISHED Published: 2019-07-03T16:57:05 Last Updated: 2024-08-05T08:30:59.596Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Elite CMS Pro 2.01. In /admin/add_sidebar.php, the ?page= parameter is vulnerable to SQL injection. Additional Analyst Notes: - CVE Program Container: References: - http://elitecms.net/download.php - https://cxsecurity.com/issue/WLB-2018060157
CVE ID: CVE-2018-12254 State: PUBLISHED Published: 2018-06-12T17:00:00 Last Updated: 2024-08-05T08:30:59.594Z Vendors: n/a Products: n/a Problem Types: n/a Description: router.php in the Harmis Ek rishta (aka ek-rishta) 2.10 component for Joomla! allows SQL Injection via the PATH_INFO to a home/requested_user/Sent%20interest/ URI. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44893/ - https://m4k4br0.github.io/sql-injection-joomla-component/
CVE ID: CVE-2018-12255 State: PUBLISHED Published: 2018-07-03T11:00:00 Last Updated: 2024-08-05T08:30:59.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XSS issue was discovered in InvoicePlane 1.5.10 via the "Quote PDF Password(Optional)" field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/V33RU/Invoice-Plane-XSS - https://development.invoiceplane.com/browse/IP-707
CVE ID: CVE-2018-12256 State: PUBLISHED Published: 2018-08-16T20:00:00 Last Updated: 2024-08-05T08:30:59.858Z Vendors: n/a Products: n/a Problem Types: n/a Description: admin/vqmods.app/vqmods.inc.php in LiteCart before 2.1.3 allows remote authenticated attackers to upload a malicious file (resulting in remote code execution) by using the text/xml or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/litecart/litecart/commit/2305368eb70a26cab34c772c9ae88787f4c3e669 - https://www.litecart.net/download
CVE ID: CVE-2018-12257 State: PUBLISHED Published: 2018-06-12T18:00:00Z Last Updated: 2024-09-17T03:07:06.361Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. There is Authenticated Custom Firmware Upgrade via DNS Hijacking. An authenticated root user with CLI access is able to remotely upgrade firmware to a custom image due to lack of SSL validation by changing the nameservers in /etc/resolv.conf to the attacker's server, and serving the expected HTTPS response containing new firmware for the device to download. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-pe
download. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12258 State: PUBLISHED Published: 2018-06-12T18:00:00Z Last Updated: 2024-09-16T23:46:31.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. Custom Firmware Upgrade is possible via an SD Card. With physical access, an attacker can upgrade the firmware in under 60 seconds by inserting an SD card containing the firmware with name 'ezviz.dav' and rebooting. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12259 State: PUBLISHED Published: 2018-06-12T18:00:00Z Last Updated: 2024-09-16T17:24:16.688Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. Root access can be obtained via UART pins without any restrictions, which leads to full system compromise. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12260 State: PUBLISHED Published: 2018-06-12T18:00:00Z Last Updated: 2024-09-17T04:25:14.108Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. The root password can be obtained in cleartext by issuing the command 'showKey' from the root CLI. This password may be the same on all devices Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12261 State: PUBLISHED Published: 2018-06-12T18:00:00Z Last Updated: 2024-09-16T18:48:22.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on Momentum Axel 720P 5.1.8 devices. All processes run as root. Additional Analyst Notes: - CVE Program Container: References: - https://rchase.com/downloads/momentum-iot-penetration-test-report.pdf
CVE ID: CVE-2018-12262 State: REJECTED Published: 2018-06-17T14:00:00 Last Updated: 2018-06-17T13:57:01 Description: No description available.
CVE ID: CVE-2018-12263 State: PUBLISHED Published: 2018-06-13T11:00:00 Last Updated: 2024-08-05T08:30:59.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: portfolioCMS 1.0.5 allows upload of arbitrary .php files via the admin/portfolio.php?newpage=true URI. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/oyeahtime/test/issues/3
CVE ID: CVE-2018-12264 State: PUBLISHED Published: 2018-06-13T11:00:00 Last Updated: 2024-08-05T08:30:59.579Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 has integer overflows in LoaderTiff::getData() in preview.cpp, leading to an out-of-bounds read in Exiv2::ValueType::setDataArea in value.hpp. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3700-1/ - https://www.debian.org/security/2018/dsa-4238 - https://github.com/TeamSeri0us/pocs/blob/master/exiv2/2-out-of-read-Poc - https://security.gentoo.org/glsa/201811-14 - https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html - https://github.com/Exiv2/exiv2/issues/366 -
11-14 - https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html - https://github.com/Exiv2/exiv2/issues/366 - https://access.redhat.com/errata/RHSA-2019:2101 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2018-12265 State: PUBLISHED Published: 2018-06-13T11:00:00 Last Updated: 2024-08-05T08:30:59.888Z Vendors: n/a Products: n/a Problem Types: n/a Description: Exiv2 0.26 has an integer overflow in the LoaderExifJpeg class in preview.cpp, leading to an out-of-bounds read in Exiv2::MemIo::read in basicio.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/TeamSeri0us/pocs/blob/master/exiv2/1-out-of-read-Poc - https://usn.ubuntu.com/3700-1/ - https://www.debian.org/security/2018/dsa-4238 - https://security.gentoo.org/glsa/201811-14 - https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html - https://github.com/Exiv2/exiv2/issues/365 - htt
4 - https://lists.debian.org/debian-lts-announce/2018/06/msg00010.html - https://github.com/Exiv2/exiv2/issues/365 - https://access.redhat.com/errata/RHSA-2019:2101 - http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE ID: CVE-2018-12266 State: PUBLISHED Published: 2018-06-13T11:00:00 Last Updated: 2024-08-05T08:30:59.648Z Vendors: n/a Products: n/a Problem Types: n/a Description: system\errors\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/lzlzh2016/CVE/blob/master/XSS.md
CVE ID: CVE-2018-12268 State: PUBLISHED Published: 2018-06-13T11:00:00 Last Updated: 2024-08-05T08:30:59.653Z Vendors: n/a Products: n/a Problem Types: n/a Description: acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection into an smbclient command line. Additional Analyst Notes: - CVE Program Container: References: - http://b3n7s.github.io/acccheck-command-injection.html
CVE ID: CVE-2018-12270 State: PUBLISHED Published: 2019-05-20T13:32:54 Last Updated: 2024-08-05T08:30:59.571Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Valve Steam 1528829181 BETA, it is possible to perform a homograph / homoglyph attack to create fake URLs in the client, which may trick users into visiting unintended web sites. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/VixusFoxy/CVE/wiki/CVE-2018-12270
CVE ID: CVE-2018-12271 State: PUBLISHED Published: 2018-06-13T23:00:00 Last Updated: 2024-08-05T08:30:59.827Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the com.getdropbox.Dropbox app 100.2 for iOS. The LAContext class for Biometric (TouchID) validation allows authentication bypass by overriding the LAContext return Boolean value to be "true" because the kSecAccessControlUserPresence protection mechanism is not used. In other words, an attacker could authenticate with an arbitrary fingerprint. NOTE: the vendor indicates that this is not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak ha
s not an attack of interest within the context of their threat model, which excludes iOS devices on which a jailbreak has occurred Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dropbox.com/s/n880ob3gtvfwryu/20180609_013320.mp4?dl=0 - https://hackerone.com/reports/363544 - https://gist.github.com/tanprathan/6e8ed195a2e05b7f9d9a342dbdacb349
CVE ID: CVE-2018-12272 State: PUBLISHED Published: 2018-06-13T13:00:00Z Last Updated: 2024-09-17T03:43:19.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: xowl/request.php in Ximdex 4.0 has XSS via the content parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XIMDEX/ximdex/issues/148
CVE ID: CVE-2018-12273 State: PUBLISHED Published: 2018-06-13T13:00:00Z Last Updated: 2024-09-17T00:37:22.731Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/XIMDEX/ximdex/issues/149
CVE ID: CVE-2018-12290 State: PUBLISHED Published: 2018-06-13T14:00:00Z Last Updated: 2024-09-16T23:46:35.580Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Yii2-StateMachine extension v2.x.x for Yii2 has XSS. Additional Analyst Notes: - CVE Program Container: References: - http://www.iwantacve.cn/index.php/archives/40/
CVE ID: CVE-2018-12291 State: PUBLISHED Published: 2018-06-13T14:00:00Z Last Updated: 2024-09-17T03:22:37.808Z Vendors: n/a Products: n/a Problem Types: n/a Description: The on_get_missing_events function in handlers/federation.py in Matrix Synapse before 0.31.1 has a security bug in the get_missing_events federation API where event visibility rules were not applied correctly. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matrix-org/synapse/releases/tag/v0.31.1 - https://github.com/matrix-org/synapse/pull/3371
CVE ID: CVE-2018-12292 State: PUBLISHED Published: 2018-06-13T14:00:00 Last Updated: 2024-08-05T08:30:59.836Z Vendors: n/a Products: n/a Problem Types: n/a Description: A use-after-free vulnerability exists in DOMProxyHandler::EnsureExpandoObject in Pale Moon before 27.9.3. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/44900/ - https://www.palemoon.org/releasenotes.shtml
CVE ID: CVE-2018-12293 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:30:59.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: The getImageData function in the ImageBufferCairo class in WebCore/platform/graphics/cairo/ImageBufferCairo.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.3 and WPE WebKit prior to version 2.20.1, is vulnerable to a heap-based buffer overflow triggered by an integer overflow, which could be abused by crafted HTML content. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=186384 - https://security.gentoo.org/glsa/201808-04 - http://www.securityfocus.com/archive
gs.webkit.org/show_bug.cgi?id=186384 - https://security.gentoo.org/glsa/201808-04 - http://www.securityfocus.com/archive/1/542087/100/0/threaded - https://www.exploit-db.com/exploits/45205/ - https://trac.webkit.org/changeset/232618 - https://usn.ubuntu.com/3687-1/ - http://packetstormsecurity.com/files/148200/WebKitGTK-Data-Leak-Code-Execution.html - http://www.openwall.com/lists/oss-security/2018/06/14/1
CVE ID: CVE-2018-12294 State: PUBLISHED Published: 2018-06-19T21:00:00 Last Updated: 2024-08-05T08:30:59.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit, as used in WebKitGTK+ prior to version 2.20.2, is vulnerable to a use after free for a WebCore::TextureMapperLayer object. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.webkit.org/show_bug.cgi?id=184729 - https://trac.webkit.org/changeset/231300/webkit - https://security.gentoo.org/glsa/201808-04 - http://www.securityfocus.com/archive/1/542087/100/0/threaded - http://packetstormsecurity.com/files/148200/WebKitGTK-Data-Leak-Code-