Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2009-0097 State: PUBLISHED Published: 2009-02-10T22:13:00 Last Updated: 2024-08-07T04:24:18.074Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Visio 2002 SP2 and 2003 SP3 does not properly validate memory allocation for Visio files, which allows remote attackers to execute arbitrary code via a crafted file, aka "Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/0391 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-005 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6188 - http://www.us-c
ms09-005 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6188 - http://www.us-cert.gov/cas/techalerts/TA09-041A.html
CVE ID: CVE-2009-0098 State: PUBLISHED Published: 2009-02-10T22:13:00 Last Updated: 2024-08-07T04:24:18.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51837 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6114 - https://docs.microsoft.com/en-us/security-updates/securit
ository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6114 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-003 - http://www.us-cert.gov/cas/techalerts/TA09-041A.html - http://secunia.com/advisories/33838
CVE ID: CVE-2009-0099 State: PUBLISHED Published: 2009-02-10T22:13:00 Last Updated: 2024-08-07T04:24:17.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Electronic Messaging System Microsoft Data Base (EMSMDB32) provider in Microsoft Exchange 2000 Server SP3 and Exchange Server 2003 SP2, as used in Exchange System Attendant, allows remote attackers to cause a denial of service (application outage) via a malformed MAPI command, aka "Literal Processing Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6159 - https://docs.microsoft.com/en-us/security-updates/s
rg/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6159 - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-003 - http://osvdb.org/51838 - http://www.us-cert.gov/cas/techalerts/TA09-041A.html - http://secunia.com/advisories/33838
CVE ID: CVE-2009-0100 State: PUBLISHED Published: 2009-04-15T03:49:00 Last Updated: 2024-08-07T04:24:17.716Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel in Microsoft Office 2004 and 2008 for Mac; Microsoft Office Excel Viewer and Excel Viewer 2003 SP3; and Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 do not properly parse the Excel spreadsheet file format, which allows remote attackers to execute arbitrary code via a crafted spreadsheet that contains a malformed object with "an offset and a two-byte value" that trigger a memory calculation error, aka "Memory Co
ontains a malformed object with "an offset and a two-byte value" that trigger a memory calculation error, aka "Memory Corruption Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - http://www.vupen.com/english/advisories/2009/1023 - http://www.securityfocus.com/archive/1/502696/100/0/threaded - http://www.us-cert.gov/cas/techalerts/TA09-104A.html - http://www.fortiguardcenter.com/advisory/FGA-2009-16.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-009 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6043 - http://osvdb.org/53665 - http://www.securitytracker.com/id?1022039
CVE ID: CVE-2009-0101 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2009-0102 State: PUBLISHED Published: 2009-12-09T18:00:00 Last Updated: 2024-08-07T04:24:18.249Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly handle memory allocation for Project files, which allows remote attackers to execute arbitrary code via a malformed file, aka "Project Memory Validation Vulnerability." Additional Analyst Notes: - CVE Program Container: References: - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6298 - http://www.us-cert.gov/cas/techalerts/TA09-342A.html - https://docs.microsoft.com/en-us/security-updates/securitybul
8 - http://www.us-cert.gov/cas/techalerts/TA09-342A.html - https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-074
CVE ID: CVE-2009-0103 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple PHP remote file inclusion vulnerabilities in playSMS 0.9.3 allow remote attackers to execute arbitrary PHP code via a URL in the (1) apps_path[plug] parameter to plugin/gateway/gnokii/init.php, the (2) apps_path[themes] parameter to plugin/themes/default/init.php, and the (3) apps_path[libs] parameter to lib/function.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7687 - http://www.securityfocus.com/bid/33138 - http://secunia.com/advisories/33386 - http://secur
ploit-db.com/exploits/7687 - http://www.securityfocus.com/bid/33138 - http://secunia.com/advisories/33386 - http://securityreason.com/securityalert/4888
CVE ID: CVE-2009-0104 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:18.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in EZpack 4.2b2 allows remote attackers to execute arbitrary SQL commands via the qType parameter in a webboard prog action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33131 - https://www.exploit-db.com/exploits/7680 - http://securityreason.com/securityalert/4890
CVE ID: CVE-2009-0105 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in index.php in EZpack 4.2b2 allows remote attackers to inject arbitrary web script or HTML via the mdfd parameter in a prog action. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33131 - https://www.exploit-db.com/exploits/7680 - http://securityreason.com/securityalert/4890
CVE ID: CVE-2009-0106 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.639Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to execute arbitrary SQL commands via the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51144 - http://www.securityfocus.com/bid/33115 - http://secunia.com/advisories/33331 - https://exchange.xforce.ibmcloud.com/vulnerabilities/43264 - https://www.exploit-db.com/exploits/7672
CVE ID: CVE-2009-0107 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.520Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site scripting (XSS) vulnerability in profile.php in PHPAuctions (aka PHPAuctionSystem) allows remote attackers to inject arbitrary web script or HTML via the user_id parameter. Additional Analyst Notes: - CVE Program Container: References: - http://osvdb.org/51145 - http://www.securityfocus.com/bid/33115 - http://secunia.com/advisories/33331 - https://www.exploit-db.com/exploits/7672
CVE ID: CVE-2009-0108 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.927Z Vendors: n/a Products: n/a Problem Types: n/a Description: PHPAuctions (aka PHPAuctionSystem) allows remote attackers to bypass authentication and gain administrative access via modified (1) PHPAUCTION_RM_ID, (2) PHPAUCTION_RM_NAME, (3) PHPAUCTION_RM_USERNAME, and (4) PHPAUCTION_RM_EMAIL cookies. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33120 - http://securityreason.com/securityalert/4891 - http://osvdb.org/51146 - https://www.exploit-db.com/exploits/7674 - http://secunia.com/advisories/33331
CVE ID: CVE-2009-0109 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:18.327Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in index.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. NOTE: some of these details are obtained from third party information. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7682 - http://securityreason.com/securityalert/4892 - http://www.securityfocus.com/bid/33132 - http://secunia.com/advisories/33395
CVE ID: CVE-2009-0110 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.636Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in read.php in RiotPix 0.61 and earlier allows remote attackers to execute arbitrary SQL commands via the forumid parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7679 - http://securityreason.com/securityalert/4893 - http://secunia.com/advisories/33395 - http://www.securityfocus.com/bid/33129
CVE ID: CVE-2009-0111 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33135 - http://securityreason.com/securityalert/4894 - http://secunia.com/advisories/33393 - https://www.exploit-db.com/exploits/7683
CVE ID: CVE-2009-0112 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross-site request forgery (CSRF) vulnerability in admin/agent_edit.asp in PollPro 3.0 allows remote attackers to create or modify accounts as administrators via the username, password, and name parameters. Additional Analyst Notes: - CVE Program Container: References: - https://exchange.xforce.ibmcloud.com/vulnerabilities/47754 - http://securityreason.com/securityalert/4895 - http://secunia.com/advisories/33319 - http://marc.info/?l=bugtraq&m=123117044713213&w=2
CVE ID: CVE-2009-0113 State: PUBLISHED Published: 2009-01-09T18:00:00 Last Updated: 2024-08-07T04:24:17.132Z Vendors: n/a Products: n/a Problem Types: n/a Description: Directory traversal vulnerability in attachmentlibrary.php in the XStandard component for Joomla! 1.5.8 and earlier allows remote attackers to list arbitrary directories via a .. (dot dot) in the X_CMS_LIBRARY_PATH HTTP header. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33143 - http://securityreason.com/securityalert/4896 - https://www.exploit-db.com/exploits/7691 - http://secunia.com/advisories/33377
CVE ID: CVE-2009-0114 State: PUBLISHED Published: 2009-02-26T16:00:00 Last Updated: 2024-08-07T04:24:17.673Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in the Settings Manager in Adobe Flash Player 9.x before 9.0.159.0 and 10.x before 10.0.22.87, and possibly other versions, allows remote attackers to trick a user into visiting an arbitrary URL via unknown vectors, related to "a potential Clickjacking issue variant." Additional Analyst Notes: - CVE Program Container: References: - http://isc.sans.org/diary.html?storyid=5929 - http://support.apple.com/kb/HT3549 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16
/support.apple.com/kb/HT3549 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16419 - http://secunia.com/advisories/35074 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6662 - http://secunia.com/advisories/34226 - https://exchange.xforce.ibmcloud.com/vulnerabilities/48902 - http://lists.apple.com/archives/security-announce/2009/May/msg00002.html - http://securitytracker.com/id?1021751 - http://www.vupen.com/english/advisories/2009/0743 - http://www.adobe.com/support/security/bulletins/apsb09-01.html - http://www.vupen.com/english/advisories/2009/0513 - http://security.gentoo.org/glsa/glsa-200903-23.xml - http:/
1.html - http://www.vupen.com/english/advisories/2009/0513 - http://security.gentoo.org/glsa/glsa-200903-23.xml - http://www.us-cert.gov/cas/techalerts/TA09-133A.html - http://www.vupen.com/english/advisories/2009/1297 - http://secunia.com/advisories/34293 - http://sunsolve.sun.com/search/document.do?assetkey=1-66-254909-1
CVE ID: CVE-2009-0115 State: PUBLISHED Published: 2009-03-30T16:00:00 Last Updated: 2024-08-07T04:24:17.823Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Device Mapper multipathing driver (aka multipath-tools or device-mapper-multipath) 0.4.8, as used in SUSE openSUSE, SUSE Linux Enterprise Server (SLES), Fedora, and possibly other operating systems, uses world-writable permissions for the socket file (aka /var/run/multipathd.sock), which allows local users to send arbitrary commands to the multipath daemon. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html - http://secunia.com/advisor
r: References: - http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00004.html - http://secunia.com/advisories/34759 - http://secunia.com/advisories/38794 - http://lists.vmware.com/pipermail/security-announce/2010/000082.html - http://www.debian.org/security/2009/dsa-1767 - http://secunia.com/advisories/34642 - http://secunia.com/advisories/34694 - http://support.avaya.com/elmodocs2/security/ASA-2009-128.htm - http://secunia.com/advisories/34418 - http://secunia.com/advisories/34710 - https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00236.html - http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html - http://launchpad.net/bugs/cve/2009-01
tml - http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html - http://launchpad.net/bugs/cve/2009-0115 - https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9214 - https://www.redhat.com/archives/fedora-package-announce/2009-April/msg00231.html - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691 - http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 - http://download.opensuse.org/update/10.3-test/repodata/patch-kpartx-6082.xml - http://www.vupen.com/english/advisories/2010/0528
CVE ID: CVE-2009-0119 State: PUBLISHED Published: 2009-01-14T23:00:00 Last Updated: 2024-08-07T04:24:17.443Z Vendors: n/a Products: n/a Problem Types: n/a Description: Buffer overflow in Microsoft Windows XP SP3 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .chm file. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/7720 - http://www.securityfocus.com/bid/33204 - http://securityreason.com/securityalert/4912
CVE ID: CVE-2009-0120 State: PUBLISHED Published: 2009-01-15T00:00:00 Last Updated: 2024-08-07T04:24:18.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: The IBM WebSphere DataPower XML Security Gateway XS40 with firmware 3.6.1.5 allows remote attackers to cause a denial of service (device reboot) by sending data over an established SSL connection, as demonstrated by the abc\r\n\r\n string data. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/33169 - http://www.securityfocus.com/archive/1/499870/100/0/threaded - http://www.vupen.com/english/advisories/2009/0111 - http://securityreason.com/securityalert/4911 - http://www.security
- http://www.vupen.com/english/advisories/2009/0111 - http://securityreason.com/securityalert/4911 - http://www.securitytracker.com/id?1021547
CVE ID: CVE-2009-0121 State: PUBLISHED Published: 2009-01-15T00:00:00Z Last Updated: 2024-09-17T00:11:05.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in frontpage.php in Goople CMS 1.8.2 allows remote attackers to execute arbitrary SQL commands via the password parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33393
CVE ID: CVE-2009-0122 State: PUBLISHED Published: 2009-01-15T17:00:00 Last Updated: 2024-08-07T04:24:17.554Z Vendors: n/a Products: n/a Problem Types: n/a Description: hplip.postinst in HP Linux Imaging and Printing (HPLIP) 2.7.7 and 2.8.2 on Ubuntu allows local users to change the ownership of arbitrary files via unspecified manipulations in advance of an HPLIP installation or upgrade by an administrator, related to the product's attempt to correct the ownership of its configuration files within home directories. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33539 - http://www.securityfocus.com/bid/33249 - http://www.ubuntu.com/usn/usn-708-1
s: - http://secunia.com/advisories/33539 - http://www.securityfocus.com/bid/33249 - http://www.ubuntu.com/usn/usn-708-1 - https://launchpad.net/bugs/191299
CVE ID: CVE-2009-0123 State: PUBLISHED Published: 2009-01-15T17:00:00 Last Updated: 2024-08-07T04:24:17.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unspecified vulnerability in Apple Safari on Mac OS X 10.5 and Windows allows remote attackers to read arbitrary files on a client machine via vectors related to the association of Safari with the (1) feed, (2) feeds, and (3) feedsearch URL types for RSS feeds. NOTE: as of 20090114, the only disclosure is a vague pre-advisory. However, because it is from a well-known researcher, it is being assigned a CVE identifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytrack
ntifier for tracking purposes. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id?1021581 - http://isc.sans.org/diary.html?storyid=5689 - http://secunia.com/advisories/33458 - https://exchange.xforce.ibmcloud.com/vulnerabilities/47917 - http://www.securityfocus.com/bid/33234 - http://brian.mastenbrook.net/display/27
CVE ID: CVE-2009-0124 State: PUBLISHED Published: 2009-01-15T17:00:00 Last Updated: 2024-08-07T04:24:17.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: The tqsl_verifyDataBlock function in openssl_cert.cpp in American Radio Relay League (ARRL) tqsllib 2.0 does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. Additional Analyst Notes: - CVE Program Container: References: - http://openwall.com/lists/oss-security/2009/01/12/4 - http://secunia.com/advisories/33543 - https://www.redhat.com/archives/fe
/openwall.com/lists/oss-security/2009/01/12/4 - http://secunia.com/advisories/33543 - https://www.redhat.com/archives/fedora-package-announce/2009-January/msg00557.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511509 - https://bugzilla.redhat.com/show_bug.cgi?id=479650
CVE ID: CVE-2009-0125 State: PUBLISHED Published: 2009-01-15T17:00:00 Last Updated: 2024-08-07T04:24:17.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: NOTE: this issue has been disputed by the upstream vendor. nasl/nasl_crypto2.c in the Nessus Attack Scripting Language library (aka libnasl) 2.2.11 does not properly check the return value from the OpenSSL DSA_do_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: the upstream vendor has disputed this issue, stating "while we do misuse this function (this is a bug), it has absolutely no security ramificat
disputed this issue, stating "while we do misuse this function (this is a bug), it has absolutely no security ramification. Additional Analyst Notes: - CVE Program Container: References: - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html - http://www.attrition.org/pipermail/vim/2009-January/002133.html - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511517 - http://openwall.com/lists/oss-security/2009/01/12/4 - https://bugzilla.redhat.com/show_bug.cgi?id=479655 - http://cvs.fedoraproject.org/viewvc/rpms/libnasl/F-10/libnasl.spec?r1=1.16&r2=1.17
CVE ID: CVE-2009-0126 State: PUBLISHED Published: 2009-01-15T17:00:00 Last Updated: 2024-08-07T04:24:17.535Z Vendors: n/a Products: n/a Problem Types: n/a Description: The decrypt_public function in lib/crypt.cpp in the client in Berkeley Open Infrastructure for Network Computing (BOINC) 6.2.14 and 6.4.5 does not check the return value from the OpenSSL RSA_public_decrypt function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. Additional Analyst Notes: - CVE Program Container: References: - http://secunia.com/advisories/33828 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521 - ht
tainer: References: - http://secunia.com/advisories/33828 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511521 - http://secunia.com/advisories/33806 - http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html - http://openwall.com/lists/oss-security/2009/01/12/4 - http://boinc.berkeley.edu/trac/changeset/16883 - http://boinc.berkeley.edu/trac/ticket/823 - https://bugzilla.redhat.com/show_bug.cgi?id=479664 - https://www.redhat.com/archives/fedora-package-announce/2009-February/msg00034.html
CVE ID: CVE-2009-0127 State: PUBLISHED Published: 2009-01-15T17:00:00Z Last Updated: 2024-09-16T21:03:01.336Z Vendors: n/a Products: n/a Problem Types: n/a Description: M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto. Additional Analyst Notes: - CVE Program Container: References: - https://b
functions are not used anywhere in m2crypto. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=479676 - http://openwall.com/lists/oss-security/2009/01/12/4 - http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511515