Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2010-2739 State: PUBLISHED Published: 2010-09-07T17:00:00Z Last Updated: 2024-09-16T20:43:28.961Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in the CreateDIBPalette function in win32k.sys in Microsoft Windows XP SP3, Server 2003 R2 Enterprise SP2, Vista Business SP1, Windows 7, and Server 2008 SP2 allows local users to cause a denial of service (crash) and possibly execute arbitrary code by performing a clipboard operation (GetClipboardData API function) with a crafted bitmap with a palette that contains a large number of colors. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40870 - http://www.ragest
Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/40870 - http://www.ragestorm.net/blogs/?p=255 - http://www.vupen.com/english/advisories/2010/2029 - http://blogs.technet.com/b/msrc/archive/2010/08/10/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability.aspx - https://msrc.microsoft.com/blog/2010/08/update-on-the-publicly-disclosed-win32k-sys-eop-vulnerability/
CVE ID: CVE-2010-2740 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:48.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenType Font (OTF) format driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly perform memory allocation during font parsing, which allows local users to gain privileges via a crafted application, aka "OpenType Font Parsing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-078 - http://support.avaya.com/css/P8/documents/100113218 - https://oval.cisecurity.org/repository/search/definition
s10-078 - http://support.avaya.com/css/P8/documents/100113218 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7258 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-2741 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:47.994Z Vendors: n/a Products: n/a Problem Types: n/a Description: The OpenType Font (OTF) format driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 performs an incorrect integer calculation during font processing, which allows local users to gain privileges via a crafted application, aka "OpenType Font Validation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-078 - http://support.avaya.com/css/P8/documents/100113218 - https://oval.cisecurity.org/repository/search/defini
10/ms10-078 - http://support.avaya.com/css/P8/documents/100113218 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6742 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-2742 State: PUBLISHED Published: 2010-12-16T19:00:00 Last Updated: 2024-08-07T02:46:47.202Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Netlogon RPC Service in Microsoft Windows Server 2003 SP2 and Server 2008 Gold, SP2, and R2, when the domain controller role is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and reboot) via a crafted RPC packet, aka "Netlogon RPC Null dereference DOS Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.us-cert.gov/cas/techalerts/TA10-348A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-101 - https://oval.ci
rts/TA10-348A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-101 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11963 - http://www.securitytracker.com/id?1024883
CVE ID: CVE-2010-2743 State: PUBLISHED Published: 2011-01-20T20:00:00 Last Updated: 2024-08-07T02:46:47.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel-mode drivers in Microsoft Windows XP SP3 do not properly perform indexing of a function-pointer table during the loading of keyboard layouts from disk, which allows local users to gain privileges via a crafted application, as demonstrated in the wild in July 2010 by the Stuxnet worm, aka "Win32k Keyboard Layout Vulnerability." NOTE: this might be a duplicate of CVE-2010-3888 or CVE-2010-3889. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/ova
ional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7514 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-073
CVE ID: CVE-2010-2744 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:48.406Z Vendors: n/a Products: n/a Problem Types: n/a Description: The kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly manage a window class, which allows local users to gain privileges by creating a window, then using (1) the SetWindowLongPtr function to modify the popup menu structure, or (2) the SwitchWndProc function with a switch window information pointer, which is not re-initialized when a WM_NCCREATE message is processed, aka "Win32k Window Class Vulnerabil
mation pointer, which is not re-initialized when a WM_NCCREATE message is processed, aka "Win32k Window Class Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12085 - http://mista.nu/blog/2010/12/01/windows-class-handling-gone-wrong/ - http://www.exploit-db.com/exploits/15894 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-073
CVE ID: CVE-2010-2745 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:47.257Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Windows Media Player (WMP) 9 through 12 does not properly deallocate objects during a browser reload action, which allows user-assisted remote attackers to execute arbitrary code via crafted media content referenced in an HTML document, aka "Windows Media Player Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6653 - http://www.securitytracker.com/id?1024550 - https://docs.microsoft
earch/definition/oval%3Aorg.mitre.oval%3Adef%3A6653 - http://www.securitytracker.com/id?1024550 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-082 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-2746 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:47.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heap-based buffer overflow in Comctl32.dll (aka the common control library) in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, when a third-party SVG viewer is used, allows remote attackers to execute arbitrary code via a crafted HTML document that triggers unspecified messages from this viewer, aka "Comctl32 Heap Overflow Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?
flow Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1024549 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7272 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-081
CVE ID: CVE-2010-2747 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:47.247Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly handle an uninitialized pointer during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Uninitialized Pointer Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/514310/100/0/threaded - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 - https://oval.cisecurity.org/r
aded - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7121 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-2748 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:48.142Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Word 2002 SP3 and Office 2004 for Mac do not properly check an unspecified boundary during parsing of a Word document, which allows remote attackers to execute arbitrary code via a crafted document that triggers memory corruption, aka "Word Boundary Check Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7375 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 - http://
rg.mitre.oval%3Adef%3A7375 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html
CVE ID: CVE-2010-2749 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2010-2750 State: PUBLISHED Published: 2010-10-13T18:00:00 Last Updated: 2024-08-07T02:46:47.255Z Vendors: n/a Products: n/a Problem Types: n/a Description: Array index error in Microsoft Word 2002 SP3 and Office 2004 for Mac allows remote attackers to execute arbitrary code via a crafted Word document that triggers memory corruption, aka "Word Index Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/archive/1/514292/100/0/threaded - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-079 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - https://oval.cisecurity.org/repository/search/definit
/ms10-079 - http://www.us-cert.gov/cas/techalerts/TA10-285A.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7582
CVE ID: CVE-2010-2751 State: PUBLISHED Published: 2010-07-30T20:00:00 Last Updated: 2024-08-07T02:46:48.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: The nsDocShell::OnRedirectStateChange function in docshell/base/nsDocShell.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to spoof the SSL security status of a document via vectors involving multiple requests, a redirect, and the history.back and history.forward JavaScript functions. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/security/announce/2010/mfsa2010-45.html - https://bugzilla.mozilla.org/show_bug.cgi?id=
rences: - http://www.mozilla.org/security/announce/2010/mfsa2010-45.html - https://bugzilla.mozilla.org/show_bug.cgi?id=536466 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11688
CVE ID: CVE-2010-2752 State: PUBLISHED Published: 2010-07-30T20:00:00 Last Updated: 2024-08-07T02:46:48.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in an array class in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code by placing many Cascading Style Sheets (CSS) values in an array, related to references to external font resources and an inconsistency between 16-bit and 32-bit integers. Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aor
Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11680 - http://www.securityfocus.com/bid/41852 - http://www.zerodayinitiative.com/advisories/ZDI-10-133/ - http://www.securityfocus.com/archive/1/512514 - https://bugzilla.mozilla.org/show_bug.cgi?id=574059 - http://www.mozilla.org/security/announce/2010/mfsa2010-39.html
CVE ID: CVE-2010-2753 State: PUBLISHED Published: 2010-07-30T20:00:00 Last Updated: 2024-08-07T02:46:48.173Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 allows remote attackers to execute arbitrary code via a large selection attribute in a XUL tree element, which triggers a use-after-free. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=571106 - http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html - http://www.mozilla.org/security/anno
1106 - http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html - http://www.mozilla.org/security/announce/2010/mfsa2010-40.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10958 - http://www.zerodayinitiative.com/advisories/ZDI-10-131/ - http://www.securityfocus.com/bid/41853 - http://www.securityfocus.com/archive/1/512510
CVE ID: CVE-2010-2754 State: PUBLISHED Published: 2010-07-29T18:00:00 Last Updated: 2024-08-07T02:46:47.296Z Vendors: n/a Products: n/a Problem Types: n/a Description: dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/securi
e window.onerror handler. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/security/announce/2010/mfsa2010-47.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11770 - https://bugzilla.mozilla.org/show_bug.cgi?id=568564
CVE ID: CVE-2010-2755 State: PUBLISHED Published: 2010-07-29T18:00:00 Last Updated: 2024-08-07T02:46:47.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: layout/generic/nsObjectFrame.cpp in Mozilla Firefox 3.6.7 does not properly free memory in the parameter array of a plugin instance, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted HTML document, related to the DATA and SRC attributes of an OBJECT element. NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-1214. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/security/announce/2010/mfsa2
14. Additional Analyst Notes: - CVE Program Container: References: - http://www.mozilla.org/security/announce/2010/mfsa2010-48.html - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11961 - https://bugzilla.mozilla.org/show_bug.cgi?id=575836
CVE ID: CVE-2010-2756 State: PUBLISHED Published: 2010-08-13T19:00:00 Last Updated: 2024-08-07T02:46:48.659Z Vendors: n/a Products: n/a Problem Types: n/a Description: Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedoraproject.org/pipermail/package-announce/2
ect.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html - http://secunia.com/advisories/40892 - https://bugzilla.redhat.com/show_bug.cgi?id=623423 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html - http://www.securityfocus.com/bid/42275 - https://bugzilla.mozilla.org/show_bug.cgi?id=417048 - http://www.bugzilla.org/security/3.2.7/ - http://secunia.com/advisories/41128 - http://www.vupen.com/english/advisories/2010/2205
CVE ID: CVE-2010-2757 State: PUBLISHED Published: 2010-08-13T19:00:00 Last Updated: 2024-08-07T02:46:47.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send impersonation notifications, which makes it easier for remote authenticated users to impersonate other users without discovery. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=450013 - http://www.vupen.com/english/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lis
sh/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html - http://secunia.com/advisories/40892 - https://bugzilla.redhat.com/show_bug.cgi?id=623423 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html - http://www.securityfocus.com/bid/42275 - http://www.bugzilla.org/security/3.2.7/ - http://secunia.com/advisories/41128 - http://www.vupen.com/english/advisories/2010/2205
CVE ID: CVE-2010-2758 State: PUBLISHED Published: 2010-08-13T19:00:00 Last Updated: 2024-08-07T02:46:48.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=519835 - http://www.vupen.com/english/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-
35 - http://www.vupen.com/english/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html - http://secunia.com/advisories/40892 - https://bugzilla.redhat.com/show_bug.cgi?id=623423 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html - http://www.securityfocus.com/bid/42275 - http://www.bugzilla.org/security/3.2.7/ - https://bugzilla.mozilla.org/show_bug.cgi?id=577139 - http://secunia.com/advisories/41128 - http://www.vupen.com/english/advisories/2010/2205
CVE ID: CVE-2010-2759 State: PUBLISHED Published: 2010-08-13T19:00:00 Last Updated: 2024-08-07T02:46:48.717Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2) attachment phrases, which allows remote authenticated users to cause a denial of service (bug invisibility) via a crafted comment. Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedorap
ies/2010/2035 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046534.html - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html - http://secunia.com/advisories/40892 - https://bugzilla.redhat.com/show_bug.cgi?id=623423 - http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046546.html - http://www.securityfocus.com/bid/42275 - https://bugzilla.mozilla.org/show_bug.cgi?id=583690 - http://www.bugzilla.org/security/3.2.7/ - http://secunia.com/advisories/41128 - http://www.vupen.com/english/advisories/2010/2205
CVE ID: CVE-2010-2760 State: PUBLISHED Published: 2010-09-09T18:00:00 Last Updated: 2024-08-07T02:46:48.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: Use-after-free vulnerability in the nsTreeSelection function in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 might allow remote attackers to execute arbitrary code via vectors involving a XUL tree selection, related to a "dangling pointer vulnerability." NOTE: this issue exists because of an incomplete fix for CVE-2010-2753. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/61
Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/61660 - https://bugzilla.mozilla.org/show_bug.cgi?id=585815 - http://www.mozilla.org/security/announce/2010/mfsa2010-54.html - http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html - http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox - http://lists.fedoraproject.org/pipermail/package-announce/2010-September/047282.html - http://support.avaya.com/css/P8/documents/100110210 - http://support.avaya.com/css/P8/documents/100112690 - http://secunia.com/advisories/42867 - http://www.vupen.com/english/advisories/2011/0061 - http://www.
uments/100112690 - http://secunia.com/advisories/42867 - http://www.vupen.com/english/advisories/2011/0061 - http://www.mandriva.com/security/advisories?name=MDVSA-2010:173 - http://www.vupen.com/english/advisories/2010/2323 - http://www.debian.org/security/2010/dsa-2106 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11799
CVE ID: CVE-2010-2761 State: PUBLISHED Published: 2010-12-06T20:00:00 Last Updated: 2024-08-07T02:46:47.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: The multipart_init function in (1) CGI.pm before 3.50 and (2) Simple.pm in CGI::Simple 1.112 and earlier uses a hardcoded value of the MIME boundary string in multipart/x-mixed-replace content, which allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input that contains this value, a different vulnerability than CVE-2010-3172. Additional Analyst Notes: - CVE Program Container: References: - http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb
tes: - CVE Program Container: References: - http://perl5.git.perl.org/perl.git/blobdiff/a0b94c2432b1d8c20653453a0f6970cb10f59aec..84601d63a7e34958da47dad1e61e27cb3bd467d1:/cpan/CGI/lib/CGI.pm - http://www.redhat.com/support/errata/RHSA-2011-1797.html - http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00003.html - http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053591.html - http://secunia.com/advisories/43068 - http://openwall.com/lists/oss-security/2010/12/01/2 - http://osvdb.org/69588 - http://secunia.com/advisories/43165 - http://openwall.com/lists/oss-security/2010/12/01/3 - http://www.vupen.com/english/advisories/2011/0212 - https://bugzilla.mozilla