deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-4315
Published: 2009-12-14
Description: Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS 1.0, when magic_quotes_gpc is disabled, allows remote attackers to create or modify arbitrary files via a .. (dot dot) in the nugget parameter and a modified pagevalue parameter, as demonstrated by creating and accessing a .php file to execute arbitrary PHP code.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/60902; http://packetstormsecurity.org/0912-exploits/nuggetz-exec.txt; http://secunia.com/advisories/37664
CVE: CVE-2009-4316
Published: 2009-12-14
Description: Cross-site scripting (XSS) vulnerability in searchresults_main.php in ZeeLyrics 3x allows remote attackers to inject arbitrary web script or HTML via the keyword parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37742; http://secunia.com/advisories/37742
CVE: CVE-2009-4317
Published: 2009-12-14
Description: Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez Cart allows remote attackers to inject arbitrary web script or HTML via the sid parameter in a showcat action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/ezcart-xss.txt; http://secunia.com/advisories/37693; http://www.exploit-db.com/exploits/10405
CVE: CVE-2009-4318
Published: 2009-12-14
Description: Cross-site scripting (XSS) vulnerability in index.php in Real Estate Manager 1.0.1 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0912-exploits/rem101-xss.txt; http://secunia.com/advisories/32049; http://www.exploit-db.com/exploits/10413
CVE: CVE-2009-4319
Published: 2009-12-14
Description: PHP remote file inclusion vulnerability in js/bbcodepress/bbcode-form.php in eoCMS 0.9.03 and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the BBCODE_path parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-94
References: http://secunia.com/advisories/37749; http://www.exploit-db.com/exploits/10422; http://secunia.com/advisories/37749
CVE: CVE-2009-4320
Published: 2009-12-14
Description: Cross-site scripting (XSS) vulnerability in searchform.php in The Next Generation of Genealogy Sitebuilding (TNG) 7.1.2 allows remote attackers to inject arbitrary web script or HTML via the msg parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37711; http://www.exploit-db.com/exploits/10387; https://exchange.xforce.ibmcloud.com/vulnerabilities/54726
CVE: CVE-2009-4321
Published: 2009-12-14
Description: extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other versions, allows remote attackers to read arbitrary files via a file:// URI.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/60892; http://secunia.com/advisories/37630; http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart/
CVE: CVE-2009-4322
Published: 2009-12-14
Description: extras/ipn_test_return.php in Zen Cart allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.acunetix.com/blog/websecuritynews/acusensor-curl-and-zen-cart/; http://www.securityfocus.com/archive/1/508340/100/0/threaded; http://www.zen-cart.com/forum/showthread.php?t=142784
CVE: CVE-2009-4323
Published: 2009-12-14
Description: The installation for Zen Cart stores sensitive information and insecure programs under the (1) docs, (2) extras, and (3) zc_install folders, and (4) install.txt, which allows remote attackers to obtain sensitive information, delete the database, and conduct other attacks via a direct request, different vulnerabilities than CVE-2009-4321 and CVE-2009-4322.
CVSS Score: 7.5 (HIGH)
References: http://www.zen-cart.com/forum/showthread.php?t=142784; http://www.zen-cart.com/forum/showthread.php?t=142784
CVE: CVE-2009-4324
Published: 2009-12-15
Description: Use-after-free vulnerability in the Doc.media.newPlayer method in Multimedia.api in Adobe Reader and Acrobat 9.x before 9.3, and 8.x before 8.2 on Windows and Mac OS X, allows remote attackers to execute arbitrary code via a crafted PDF file using ZLib compressed streams, as exploited in the wild in December 2009.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416, CWE-416
References: http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html; http://contagiodump.blogspot.com/2009/12/virustotal-httpwww.html; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html
CVE: CVE-2009-1380
Published: 2009-12-15
Description: Cross-site scripting (XSS) vulnerability in JMX-Console in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 allows remote attackers to inject arbitrary web script or HTML via the filter parameter, related to the key property and the position of quote and colon characters.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/37671; http://securitytracker.com/id?1023315; http://www.securityfocus.com/bid/37276
CVE: CVE-2009-2405
Published: 2009-12-15
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Web Console in the Application Server in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2.0 before 4.2.0.CP08, 4.2.2GA, 4.3 before 4.3.0.CP07, and 5.1.0GA allow remote attackers to inject arbitrary web script or HTML via the (1) monitorName, (2) objectName, (3) attribute, or (4) period parameter to createSnapshot.jsp, or the (5) monitorName, (6) objectName, (7) attribute, (8) threshold, (9) period, or (10) enabled parameter to createThresholdMonitor.jsp.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/35680; http://secunia.com/advisories/37671; http://securitytracker.com/id?1023315
CVE: CVE-2009-3554
Published: 2009-12-15
Description: Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP08 and 4.3 before 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://secunia.com/advisories/37671; http://securitytracker.com/id?1023316; http://www.redhat.com/docs/en-US/JBoss_Enterprise_Application_Platform/4.2.0.cp08/html-single/Release_Notes/index.html
CVE: CVE-2009-4034
Published: 2009-12-15
Description: PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-310
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1119&w=2; http://osvdb.org/61038
CVE: CVE-2009-4136
Published: 2009-12-15
Description: PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
CVSS Score: 6.5 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1119&w=2; http://osvdb.org/61039
CVE: CVE-2008-7248
Published: 2009-12-16
Description: Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en; http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html; http://pseudo-flaw.net/content/web-browsers/form-data-encoding-roundup/
CVE: CVE-2009-4297
Published: 2009-12-16
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139100
CVE: CVE-2009-4298
Published: 2009-12-16
Description: The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores the (1) username, (2) firstname, and (3) lastname fields within the user table, which allows attackers to obtain user account information via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139102
CVE: CVE-2009-4299
Published: 2009-12-16
Description: mod/glossary/showentry.php in the Glossary module for Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not properly perform access control, which allows attackers to read unauthorized Glossary entries via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139103
CVE: CVE-2009-4300
Published: 2009-12-16
Description: Multiple unspecified authentication plugins in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 store the MD5 hashes for passwords in the user table, even when the cached hashes are not used by the plugin, which might make it easier for attackers to obtain credentials via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139105
CVE: CVE-2009-4301
Published: 2009-12-16
Description: mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when MNET services are enabled, does not properly check permissions, which allows remote authenticated servers to execute arbitrary MNET functions.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.16.2.10&r2=1.16.2.11; http://cvs.moodle.org/moodle/mnet/lib.php?r1=1.9.2.7&r2=1.9.2.8; http://docs.moodle.org/en/Moodle_1.8.11_release_notes
CVE: CVE-2009-4302
Published: 2009-12-16
Description: login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 links to an index page on the HTTP port even when the page is served from an HTTPS port, which might cause login credentials to be sent in cleartext, even when SSL is intended, and allows remote attackers to obtain these credentials by sniffing.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139107
CVE: CVE-2009-4303
Published: 2009-12-16
Description: Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password hashes and (2) unspecified "secrets" in backup files, which might allow attackers to obtain sensitive information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139110
CVE: CVE-2009-4304
Published: 2009-12-16
Description: Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random password salt in config.php, which makes it easier for attackers to conduct brute-force password guessing attacks.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139111
CVE: CVE-2009-4305
Published: 2009-12-16
Description: SQL injection vulnerability in the SCORM module in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 allows remote authenticated users to execute arbitrary SQL commands via vectors related to an "escaping issue when processing AICC CRS file (Course_Title)."
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://docs.moodle.org/en/Moodle_1.8.11_release_notes; http://docs.moodle.org/en/Moodle_1.9.7_release_notes; http://moodle.org/mod/forum/discuss.php?d=139120
CVE: CVE-2009-3731
Published: 2009-12-16
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help 2.0 through 5.0 in VMware vCenter 4.0 before Update 1 Build 208156; VMware Server 2.0.2; VMware ESX 4.0; VMware Lab Manager 2.x; VMware vCenter Lab Manager 3.x and 4.x before 4.0.1; VMware Stage Manager 1.x before 4.0.1; WebWorks Publisher 6.x through 8.x; WebWorks Publisher 2003; and WebWorks ePublisher 9.0.x through 9.3, 2008.1 through 2008.4, and 2009.x before 2009.3 allow remote attackers to inject arbitrary web script or HTML via (1) wwhelp_entry.html, reachable through index.html and wwhsec.htm, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js, or (5) the window.opener component in wwhelp/wwhimpl/common/html/bookmark.htm, related to (a) unspecified parameters and (b) messages used in topic links for the bookmarking functionality.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2009-12/0229.html; http://lists.vmware.com/pipermail/security-announce/2009/000073.html; http://secunia.com/advisories/38749
CVE: CVE-2009-4325
Published: 2009-12-16
Description: The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 does not validate an unspecified pointer, which allows attackers to overwrite "external memory" via unknown vectors, related to a missing "check for null pointers."
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
CVE: CVE-2009-4326
Published: 2009-12-16
Description: The RAND scalar function in the Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1, when the Database Partitioning Feature (DPF) is used, produces "repeating" return values, which might allow attackers to defeat protection mechanisms based on randomization by predicting a value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT; http://secunia.com/advisories/37759
CVE: CVE-2009-4327
Published: 2009-12-16
Description: The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1 does not properly validate the size of a memory pool during a creation attempt, which allows attackers to cause a denial of service (memory consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT; http://secunia.com/advisories/37759
CVE: CVE-2009-4328
Published: 2009-12-16
Description: Unspecified vulnerability in the DRDA Services component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (server trap) by calling a SQL stored procedure in unknown circumstances.
CVSS Score: 4.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759; http://www-01.ibm.com/support/docview.wss?uid=swg1IC64298
CVE: CVE-2009-4329
Published: 2009-12-16
Description: Unspecified vulnerability in the Engine Utilities component in IBM DB2 9.5 before FP5 allows remote authenticated users to cause a denial of service (segmentation fault) by modifying the db2ra data stream sent in a request from the Load Utility.
CVSS Score: 4.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ52083
CVE: CVE-2009-4330
Published: 2009-12-16
Description: Unspecified vulnerability in db2licm in the Engine Utilities component in IBM DB2 9.5 before FP5 has unknown impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759; http://www-01.ibm.com/support/docview.wss?uid=swg1IC62501
CVE: CVE-2009-4331
Published: 2009-12-16
Description: The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 configures the High Availability (HA) scripts with incorrect file-permission and authorization settings, which has unknown impact and local attack vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT; ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
CVE: CVE-2009-4332
Published: 2009-12-16
Description: db2pd in the Problem Determination component in IBM DB2 9.1 before FP7 and 9.5 before FP5 allows attackers to cause a denial of service (NULL pointer dereference and application termination) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759
CVE: CVE-2009-4333
Published: 2009-12-16
Description: The Relational Data Services component in IBM DB2 9.5 before FP5 allows attackers to obtain the password argument from the SET ENCRYPTION PASSWORD statement via vectors involving the GET SNAPSHOT FOR DYNAMIC SQL command.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759; http://www-01.ibm.com/support/docview.wss?uid=swg1IZ38819
CVE: CVE-2009-4334
Published: 2009-12-16
Description: The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT
CVE: CVE-2009-4335
Published: 2009-12-16
Description: Multiple unspecified vulnerabilities in bundled stored procedures in the Spatial Extender component in IBM DB2 9.5 before FP5 have unknown impact and remote attack vectors, related to "remote exploits."
CVSS Score: 10.0 (HIGH)
References: ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://secunia.com/advisories/37759; http://www-01.ibm.com/support/docview.wss?uid=swg1IC62625
CVE: CVE-2009-4138
Published: 2009-12-16
Description: drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when packet-per-buffer mode is used, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unknown other impact via an unspecified ioctl associated with receiving an ISO packet that contains zero in the payload-length field.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=8c0c0cc2d9f4c523fde04bdfe41e4380dec8ee54; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html
CVE: CVE-2009-3388
Published: 2009-12-17
Description: liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before 2.0.1 might allow context-dependent attackers to cause a denial of service (application crash) or execute arbitrary code via unspecified vectors, related to "memory safety issues."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37785; http://secunia.com/advisories/37856
CVE: CVE-2009-3389
Published: 2009-12-17
Description: Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used in Mozilla Firefox 3.5 before 3.5.6 and SeaMonkey before 2.0.1, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a video with large dimensions.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html; http://secunia.com/advisories/37699
CVE: CVE-2009-3979
Published: 2009-12-17
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37703; http://secunia.com/advisories/37704
CVE: CVE-2009-3980
Published: 2009-12-17
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.6, SeaMonkey before 2.0.1, and Thunderbird allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37785; http://secunia.com/advisories/37856
CVE: CVE-2009-3981
Published: 2009-12-17
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox before 3.0.16, SeaMonkey before 2.0.1, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://secunia.com/advisories/37699; http://secunia.com/advisories/37704; http://secunia.com/advisories/37785