deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1011
Published: 2013-05-20
Description: WebKit, as used in Apple iTunes before 11.0.3, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2013-05-16-1.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2013/May/msg00000.html; http://support.apple.com/kb/HT5766
CVE: CVE-2013-1014
Published: 2013-05-20
Description: Apple iTunes before 11.0.3 does not properly verify X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2013/May/msg00000.html; http://support.apple.com/kb/HT5766; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17605
CVE: CVE-2013-3270
Published: 2013-05-20
Description: EMC VNX Control Station before 7.1.70.2 and Celerra Control Station before 6.0.70.1 have an incorrect group ownership for unspecified script files, which allows local users to gain privileges by leveraging nasadmin group membership.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0063.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0063.html
CVE: CVE-2007-6746
Published: 2013-05-21
Description: telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104397.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00052.html; http://secunia.com/advisories/53361
CVE: CVE-2012-6137
Published: 2013-05-21
Description: rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/93058; http://rhn.redhat.com/errata/RHSA-2013-0788.html; http://secunia.com/advisories/53330
CVE: CVE-2013-1964
Published: 2013-05-21
Description: Xen 4.0.x and 4.1.x incorrectly releases a grant reference when releasing a non-v1, non-transitive grant, which allows local guest administrators to cause a denial of service (host crash), obtain sensitive information, or possibly have other impacts via unspecified vectors.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104537.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00021.html; http://secunia.com/advisories/55082
CVE: CVE-2013-1977
Published: 2013-05-21
Description: OpenStack devstack uses world-readable permissions for keystone.conf, which allows local users to obtain sensitive information such as the LDAP password and admin_token secret by reading the file.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2013/04/19/2; http://www.openwall.com/lists/oss-security/2013/04/23/7; https://bugs.launchpad.net/devstack/+bug/1168252
CVE: CVE-2013-2006
Published: 2013-05-21
Description: OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html; http://rhn.redhat.com/errata/RHSA-2013-0806.html
CVE: CVE-2013-2007
Published: 2013-05-21
Description: The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c689b4f1bac352dcfd6ecb9a1d45337de0f1de67; http://lists.opensuse.org/opensuse-updates/2013-07/msg00057.html; http://osvdb.org/93032
CVE: CVE-2013-2059
Published: 2013-05-21
Description: OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-287
References: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html; http://lists.opensuse.org/opensuse-updates/2013-06/msg00085.html
CVE: CVE-2013-0941
Published: 2013-05-22
Description: EMC RSA Authentication API before 8.1 SP1, RSA Web Agent before 5.3.5 for Apache Web Server, RSA Web Agent before 5.3.5 for IIS, RSA PAM Agent before 7.0, and RSA Agent before 6.1.4 for Microsoft Windows use an improper encryption algorithm and a weak key for maintaining the stored data of the node secret for the SecurID Authentication API, which allows local users to obtain sensitive information via cryptographic attacks on this data.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0064.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0064.html
CVE: CVE-2013-0942
Published: 2013-05-22
Description: Cross-site scripting (XSS) vulnerability in EMC RSA Authentication Agent 7.1 before 7.1.1 for Web for Internet Information Services, and 7.1 before 7.1.1 for Web for Apache, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0043.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0043.html
CVE: CVE-2013-2311
Published: 2013-05-22
Description: Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN10461119/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000040; https://groups.google.com/group/web2py/msg/ca10dffa2f0b2731?dmode=source&output=gplain
CVE: CVE-2013-2836
Published: 2013-05-22
Description: Multiple unspecified vulnerabilities in Google Chrome before 27.0.1453.93 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; https://code.google.com/p/chromium/issues/detail?id=162896; https://code.google.com/p/chromium/issues/detail?id=168050
CVE: CVE-2013-2837
Published: 2013-05-22
Description: Use-after-free vulnerability in the SVG implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=235638
CVE: CVE-2013-2838
Published: 2013-05-22
Description: Google V8, as used in Google Chrome before 27.0.1453.93, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=235311
CVE: CVE-2013-2839
Published: 2013-05-22
Description: Google Chrome before 27.0.1453.93 does not properly perform a cast of an unspecified variable during handling of clipboard data, which allows remote attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=230176
CVE: CVE-2013-2840
Published: 2013-05-22
Description: Use-after-free vulnerability in the media loader in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2013-2846.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=230117
CVE: CVE-2013-2841
Published: 2013-05-22
Description: Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of Pepper resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=227350
CVE: CVE-2013-2842
Published: 2013-05-22
Description: Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of widgets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00009.html
CVE: CVE-2013-2843
Published: 2013-05-22
Description: Use-after-free vulnerability in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of speech data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=222000
CVE: CVE-2013-2844
Published: 2013-05-22
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to style resolution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=196393
CVE: CVE-2013-2845
Published: 2013-05-22
Description: The Web Audio implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=179522
CVE: CVE-2013-2846
Published: 2013-05-22
Description: Use-after-free vulnerability in the media loader in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, a different vulnerability than CVE-2013-2840.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=177620
CVE: CVE-2013-2847
Published: 2013-05-22
Description: Race condition in the workers implementation in Google Chrome before 27.0.1453.93 allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=176692
CVE: CVE-2013-2848
Published: 2013-05-22
Description: The XSS Auditor in Google Chrome before 27.0.1453.93 might allow remote attackers to obtain sensitive information via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://lists.apple.com/archives/security-announce/2013/Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
CVE: CVE-2013-2849
Published: 2013-05-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome before 27.0.1453.93 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://googlechromereleases.blogspot.com/2013/05/stable-channel-release.html; http://www.debian.org/security/2013/dsa-2695; https://code.google.com/p/chromium/issues/detail?id=171392
CVE: CVE-2013-3496
Published: 2013-05-22
Description: Infotecs ViPNet Client 3.2.10 (15632) and earlier, ViPNet Coordinator 3.2.10 (15632) and earlier, ViPNet Personal Firewall 3.1 and earlier, and ViPNet SafeDisk 4.1 (0.5643) and earlier use weak permissions (Everyone: Full Control) for a folder under %PROGRAMFILES%\Infotecs, which allows local users to gain privileges via a Trojan horse (1) executable file or (2) DLL file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-05/0072.html; http://archives.neohapsis.com/archives/bugtraq/2013-05/0072.html
CVE: CVE-2013-1204
Published: 2013-05-23
Description: Memory leak in the SNMP process in Cisco IOS XR allows remote attackers to cause a denial of service (memory consumption or process reload) by sending many port-162 UDP packets, aka Bug ID CSCug80345.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1204; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1204
CVE: CVE-2013-2781
Published: 2013-05-23
Description: Use-after-free vulnerability in the server application in 3S CODESYS Gateway 2.3.9.27 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-142-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-142-01
CVE: CVE-2012-6553
Published: 2013-05-23
Description: Heap-based buffer overflow in Resource Hacker 3.6.0.92 allows remote attackers to execute arbitrary code via a Portable Executable (PE) file with a resource section containing a string that has many tab or line feed characters.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49217; http://waleedassar.blogspot.com/2012/05/resource-hacker-heap-overflow.html; http://www.securityfocus.com/bid/53608
CVE: CVE-2012-6554
Published: 2013-05-23
Description: functions/html_to_text.php in the Chat module before 1.5.2 for activeCollab allows remote authenticated users to execute arbitrary PHP code via the message[message_text] parameter to chat/add_messag, which is not properly handled when executing the preg_replace function with the eval switch.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/81966; http://secunia.com/advisories/49246; http://www.activecollab.com/downloads/category/4/package/62/releases
CVE: CVE-2012-6555
Published: 2013-05-23
Description: Cross-site scripting (XSS) vulnerability in the LatestComment plugin 1.1 for Vanilla Forums allows remote attackers to inject arbitrary web script or HTML via the discussion title.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49249; http://www.exploit-db.com/exploits/18908; http://www.henryhoggard.co.uk/security/191/
CVE: CVE-2012-6556
Published: 2013-05-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the FirstLastNames plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) User/FirstName or (2) User/LastName parameter to the edit user page.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49215; http://www.exploit-db.com/exploits/18912; http://www.henryhoggard.co.uk/security/197
CVE: CVE-2012-6557
Published: 2013-05-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in the AboutMe plugin 1.1.1 for Vanilla Forums allow remote attackers to inject arbitrary web script or HTML via the (1) AboutMe/RealName, (2) AboutMe/Name, (3) AboutMe/Quote, (4) AboutMe/Loc, (5) AboutMe/Emp, (6) AboutMe/JobTit, (7) AboutMe/HS, (8) AboutMe/Col, (9) AboutMe/Bio, (10) AboutMe/Inter, (11) AboutMe/Mus, (12) AboutMe/Gam, (13) AboutMe/Mov, (14) AboutMe/FTV, or (15) AboutMe/Bks parameter to the Edit My Details page.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/49207; http://www.exploit-db.com/exploits/18911; http://www.henryhoggard.co.uk/security/183/
CVE: CVE-2012-6558
Published: 2013-05-23
Description: Heap-based buffer overflow in HeavenTools PE Explorer 1.99 R6 allows remote attackers to execute arbitrary code via the size value for a string in the resource section of a Portable Executable (PE) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/49239; http://waleedassar.blogspot.com/2012/05/pe-explorer-heap-overflow-vulnerability.html; http://www.securityfocus.com/bid/53618
CVE: CVE-2012-6559
Published: 2013-05-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in FreeNAC 3.02 allow remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) mac, (3) graphtype, (4) name, or (5) type parameter to stats.php; or (6) comment parameter to deviceadd.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.exploit-db.com/exploits/18900; http://www.securityfocus.com/bid/53617; https://exchange.xforce.ibmcloud.com/vulnerabilities/75761
CVE: CVE-2012-6560
Published: 2013-05-23
Description: SQL injection vulnerability in deviceadd.php in FreeNAC 3.02 allows remote attackers to execute arbitrary SQL commands via the status parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.exploit-db.com/exploits/18900; http://www.securityfocus.com/bid/53617; https://exchange.xforce.ibmcloud.com/vulnerabilities/75763
CVE: CVE-2012-6561
Published: 2013-05-23
Description: Cross-site scripting (XSS) vulnerability in engine/lib/views.php in Elgg before 1.8.5 allows remote attackers to inject arbitrary web script or HTML via the view parameter to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released; http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip; http://secunia.com/advisories/49129
CVE: CVE-2012-6562
Published: 2013-05-23
Description: engine/lib/users.php in Elgg before 1.8.5 does not properly specify permissions for the useradd action, which allows remote attackers to create arbitrary accounts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released; http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip; http://secunia.com/advisories/49129
CVE: CVE-2012-6563
Published: 2013-05-23
Description: engine/lib/access.php in Elgg before 1.8.5 does not properly clear cached access lists during plugin boot, which allows remote attackers to read private entities via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://blog.elgg.org/pg/blog/evan/read/209/elgg-185-released; http://elgg.org/getelgg.php?forward=elgg-1.8.5.zip; http://secunia.com/advisories/49129
CVE: CVE-2011-4518
Published: 2013-05-23
Description: Directory traversal vulnerability in the PmWebDir object in the web server in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to read arbitrary files via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02; http://www.promotic.eu/en/pmdoc/News.htm#ver80105; http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02
CVE: CVE-2011-4519
Published: 2013-05-23
Description: Stack-based buffer overflow in an ActiveX component in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to cause a denial of service via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02; http://www.promotic.eu/en/pmdoc/News.htm#ver80105; http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02
CVE: CVE-2011-4520
Published: 2013-05-23
Description: Heap-based buffer overflow in an ActiveX component in MICROSYS PROMOTIC before 8.1.5 allows remote attackers to cause a denial of service via a crafted web page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02; http://www.promotic.eu/en/pmdoc/News.htm#ver80105; http://ics-cert.us-cert.gov/advisories/ICSA-12-024-02
CVE: CVE-2012-4697
Published: 2013-05-23
Description: TURCK BL20 Programmable Gateway and BL67 Programmable Gateway have hardcoded accounts, which allows remote attackers to obtain administrative access via an FTP session.
CVSS Score: 10.0 (HIGH)
CWE: CWE-255
References: http://ics-cert.us-cert.gov/advisories/ICSA-13-136-01; http://ics-cert.us-cert.gov/advisories/ICSA-13-136-01
CVE: CVE-2013-0986
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted enof atoms in a movie file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770
CVE: CVE-2013-0987
Published: 2013-05-24
Description: Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted QTIF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770
CVE: CVE-2013-0988
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FPX file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770
CVE: CVE-2013-0989
Published: 2013-05-24
Description: Buffer overflow in Apple QuickTime before 7.7.4 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MP3 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.apple.com/archives/security-announce/2013/May/msg00001.html; http://support.apple.com/kb/HT5770