deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-1210
Published: 2012-02-24
Description: SQL injection vulnerability in pfile/file.php in Powie pFile 1.02 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/51982; https://exchange.xforce.ibmcloud.com/vulnerabilities/73166
CVE: CVE-2012-1211
Published: 2012-02-24
Description: Cross-site scripting (XSS) vulnerability in pfile/kommentar.php in Powie pFile 1.02 allows remote attackers to inject arbitrary web script or HTML via the filecat parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109670/Pfile-1.02-Cross-Site-Scripting-SQL-Injection.html; http://www.securityfocus.com/bid/51982; https://exchange.xforce.ibmcloud.com/vulnerabilities/73165
CVE: CVE-2012-1212
Published: 2012-02-24
Description: Cross-site scripting (XSS) vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMW_Initialize.php in Semantic Enterprise Wiki (SMW+) 1.5.6, 1.6.0_2 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to index.php/Special:FormEdit.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109637/SMW-1.5.6-Cross-Site-Scripting.html; http://secunia.com/advisories/47968; http://st2tea.blogspot.com/2012/02/smw-enterprise-wiki-156-cross-site.html
CVE: CVE-2012-1213
Published: 2012-02-24
Description: Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/files/109710/Zimbra-Cross-Site-Scripting.html; http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html; http://www.securityfocus.com/bid/51974
CVE: CVE-2012-0363
Published: 2012-02-25
Description: The web interface on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability," aka Bug ID CSCtt46871.
CVSS Score: 9.0 (HIGH)
CWE: CWE-94
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500; http://www.securitytracker.com/id?1026736; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500
CVE: CVE-2012-0364
Published: 2012-02-25
Description: Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allow remote attackers to replace the configuration file via an upload request to an unspecified URL, aka Bug ID CSCtw55495.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500; http://www.securitytracker.com/id?1026736; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500
CVE: CVE-2012-0365
Published: 2012-02-25
Description: Directory traversal vulnerability in the Local TFTP file-upload application on Cisco SRP 520 series devices with firmware before 1.1.26 and SRP 520W-U and 540 series devices with firmware before 1.2.4 allows remote authenticated users to upload software to arbitrary directories via unspecified vectors, aka Bug ID CSCtw56009.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500; http://www.securitytracker.com/id?1026736; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120223-srp500
CVE: CVE-2012-0453
Published: 2012-02-25
Description: Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-352
References: http://www.bugzilla.org/security/4.0.4/; http://www.securitytracker.com/id?1026737; https://bugzilla.mozilla.org/show_bug.cgi?id=725663
CVE: CVE-2006-7248
Published: 2012-02-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-7250, CVE-2012-1410.  Reason: this candidate was intended for one issue, but CVE users may have associated it with multiple unrelated issues. Notes: All CVE users should consult CVE-2006-7250 for the OpenSSL candidate or CVE-2012-1410 for the Kadu candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-7249
Published: 2012-02-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2006-7250, CVE-2012-1410.  Reason: this candidate was intended for one issue, but CVE users may have associated it with multiple unrelated issues. Notes: All CVE users should consult CVE-2006-7250 for the OpenSSL candidate or CVE-2012-1410 for the Kadu candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2006-7250
Published: 2012-02-29
Description: The mime_hdr_cmp function in crypto/asn1/asn_mime.c in OpenSSL 0.9.8t and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted S/MIME message.
CVSS Score: 5.0 (MEDIUM)
References: http://cvs.openssl.org/chngview?cn=22144; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6468&w=2; http://marc.info/?l=openssl-dev&m=[PII_REDACTED]4194&w=2
CVE: CVE-2012-1091
Published: 2012-02-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-1410.  Reason: This candidate is a reservation duplicate of CVE-2012-1410.  Notes: All CVE users should reference CVE-2012-1410 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-1092
Published: 2012-02-29
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-1410.  Reason: This candidate is a reservation duplicate of CVE-2012-1410.  Notes: All CVE users should reference CVE-2012-1410 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-1410
Published: 2012-02-29
Description: Multiple cross-site scripting (XSS) vulnerabilities in the History Window implementation in Kadu 0.9.0 through 0.11.0 allow remote attackers to inject arbitrary web script or HTML via a crafted (1) SMS message, (2) presence message, or (3) status description.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/02/27/26; http://www.openwall.com/lists/oss-security/2012/02/27/3; https://bugzilla.novell.com/show_bug.cgi?id=749036
CVE: CVE-2012-1418
Published: 2012-02-29
Description: Multiple unspecified vulnerabilities in Google Chrome before 17.0.963.60 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2012/02/stable-channel-update-for-chromebooks_24.html; http://googlechromereleases.blogspot.com/2012/02/stable-channel-update-for-chromebooks_24.html
CVE: CVE-2011-4486
Published: 2012-03-01
Description: Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allow remote attackers to cause a denial of service (device reload) via a crafted SCCP registration, aka Bug ID CSCtu73538.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cucm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cucm
CVE: CVE-2011-4487
Published: 2012-03-01
Description: SQL injection vulnerability in Cisco Unified Communications Manager (CUCM) with software 6.x and 7.x before 7.1(5b)su5, 8.0 before 8.0(3a)su3, and 8.5 and 8.6 before 8.6(2a)su1 and Cisco Business Edition 3000 with software before 8.6.3 and 5000 and 6000 with software before 8.6(2a)su1 allows remote attackers to execute arbitrary SQL commands via a crafted SCCP registration, aka Bug ID CSCtu73538.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cucm; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cucm
CVE: CVE-2012-0330
Published: 2012-03-01
Description: Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a malformed SIP message, aka Bug ID CSCtr20426.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs
CVE: CVE-2012-0331
Published: 2012-03-01
Description: Cisco TelePresence Video Communication Server with software before X7.0.1 allows remote attackers to cause a denial of service (device crash) via a crafted SIP packet, as demonstrated by a SIP INVITE message from a Tandberg device, aka Bug ID CSCtq73319.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-vcs
CVE: CVE-2012-0359
Published: 2012-03-01
Description: The Cisco Cius with software before 9.2(1) SR2 allows remote attackers to cause a denial of service (device crash or hang) via malformed network traffic, aka Bug ID CSCto71445.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0186.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cius; http://archives.neohapsis.com/archives/bugtraq/2012-02/0186.html
CVE: CVE-2012-0366
Published: 2012-03-01
Description: Cisco Unity Connection before 7.1.3b(Su2) allows remote authenticated users to change the administrative password by leveraging the Help Desk Administrator role, aka Bug ID CSCtd45141.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cuc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cuc
CVE: CVE-2012-0367
Published: 2012-03-01
Description: Cisco Unity Connection before 7.1.5b(Su5), 8.0 and 8.5 before 8.5.1(Su3), and 8.6 before 8.6.2 allows remote attackers to cause a denial of service (services crash) via a series of crafted TCP segments, aka Bug ID CSCtq67899.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cuc; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-cuc
CVE: CVE-2012-0368
Published: 2012-03-01
Description: The administrative management interface on Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allows remote attackers to cause a denial of service (device crash) via a malformed URL in an HTTP request, aka Bug ID CSCts81997.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-wlc; http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html
CVE: CVE-2012-0369
Published: 2012-03-01
Description: Cisco Wireless LAN Controller (WLC) devices with software 6.0 and 7.0 before 7.0.220.0, 7.1 before 7.1.91.0, and 7.2 before 7.2.103.0 allow remote attackers to cause a denial of service (device reload) via a sequence of IPv6 packets, aka Bug ID CSCtt07949.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-wlc; http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html
CVE: CVE-2012-0370
Published: 2012-03-01
Description: Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.0 and 7.1 before 7.1.91.0, when WebAuth is enabled, allow remote attackers to cause a denial of service (device reload) via a sequence of (1) HTTP or (2) HTTPS packets, aka Bug ID CSCtt47435.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-wlc; http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html
CVE: CVE-2012-0371
Published: 2012-03-01
Description: Cisco Wireless LAN Controller (WLC) devices with software 4.x, 5.x, 6.0, and 7.0 before 7.0.220.4, when CPU-based ACLs are enabled, allow remote attackers to read or modify the configuration via unspecified vectors, aka Bug ID CSCtu56709.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20120229-wlc; http://archives.neohapsis.com/archives/bugtraq/2012-02/0188.html
CVE: CVE-2011-3443
Published: 2012-03-02
Description: Use-after-free vulnerability in WebKit, as used in Apple Safari before 5.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via vectors related to improper list management for Cascading Style Sheets (CSS) @font-face rules.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://support.apple.com/kb/HT4808; http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=962; http://support.apple.com/kb/HT4808
CVE: CVE-2012-0316
Published: 2012-03-02
Description: The Cookpad 1.5.16 and earlier and Cookpad Noseru 1.1.1 and earlier applications for Android do not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://cookpad.typepad.jp/help/2012/02/23oshirase.html; http://jvn.jp/en/jp/JVN25731073/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000014
CVE: CVE-2012-0201
Published: 2012-03-02
Description: Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long profile string in a WorkStation (aka .ws) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://dev.metasploit.com/redmine/projects/framework/repository/entry/modules/exploits/windows/fileformat/ibm_pcm_ws.rb; http://www-01.ibm.com/support/docview.wss?uid=swg1IC81539; http://www-01.ibm.com/support/docview.wss?uid=swg21586166
CVE: CVE-2012-0715
Published: 2012-03-02
Description: Cross-site scripting (XSS) vulnerability in the Gantt applet viewer in IBM Tivoli Change and Configuration Management Database (CCMDB) 7.2.1 and IBM ILOG JViews Gantt allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IV16174; http://www-01.ibm.com/support/docview.wss?uid=swg1IV16174; https://exchange.xforce.ibmcloud.com/vulnerabilities/73587
CVE: CVE-2011-1385
Published: 2012-03-02
Description: IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.1.x and 2.2.x, allows remote attackers to cause a denial of service (system crash) via an ICMP Echo Reply packet that contains 1 in the Identifier field, a different vulnerability than CVE-2012-0194.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://aix.software.ibm.com/aix/efixes/security/icmp_advisory.asc; http://osvdb.org/79631; http://secunia.com/advisories/48149
CVE: CVE-2011-4189
Published: 2012-03-02
Description: The client in Novell GroupWise 8.0x through 8.02HP3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) via a long e-mail address in an Address Book (aka .NAB) file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://osvdb.org/79720; http://secunia.com/advisories/48199; http://www.novell.com/support/viewContent.do?externalId=7010205
CVE: CVE-2012-0321
Published: 2012-03-02
Description: Unspecified vulnerability in the device driver in Kingsoft Internet Security 2011 allows local users to cause a denial of service via a crafted application.
CVSS Score: 2.1 (LOW)
References: http://jvn.jp/en/jp/JVN31517714/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000019; http://www.kingsoft.jp/support/security/support_news/supportnews_20120229
CVE: CVE-2012-0838
Published: 2012-03-02
Description: Apache Struts 2 before 2.2.3.1 evaluates a string as an OGNL expression during the handling of a conversion error, which allows remote attackers to modify run-time data values, and consequently execute arbitrary code, via invalid input to a field.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://jvn.jp/en/jp/JVN79099262/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000012; http://struts.apache.org/2.3.1.2/docs/s2-007.html
CVE: CVE-2012-0317
Published: 2012-03-03
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to hijack the authentication of arbitrary users for requests that modify data via the (1) commenting feature or (2) community script.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://jvn.jp/en/jp/JVN70683217/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000015; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2012-0318
Published: 2012-03-03
Description: Multiple cross-site scripting (XSS) vulnerabilities in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allow remote attackers to inject arbitrary web script or HTML via vectors involving templates, a different issue than CVE-2012-1262.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49836527/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2012-0319
Published: 2012-03-03
Description: The file-management system in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote authenticated users to execute arbitrary commands by leveraging the file-upload feature, related to an "OS Command Injection" issue.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://jvn.jp/en/jp/JVN92683325/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000017; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2012-0320
Published: 2012-03-03
Description: Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 allows remote attackers to take control of sessions via unspecified vectors related to the (1) commenting feature and (2) community script.
CVSS Score: 7.5 (HIGH)
References: http://jvn.jp/en/jp/JVN20083397/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000018; http://www.debian.org/security/2012/dsa-2423
CVE: CVE-2012-1262
Published: 2012-03-03
Description: Cross-site scripting (XSS) vulnerability in cgi-bin/mt/mt-wizard.cgi in Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13, when the product is incompletely installed, allows remote attackers to inject arbitrary web script or HTML via the dbuser parameter, a different vulnerability than CVE-2012-0318.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN49836527/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000016; http://osvdb.org/79470
CVE: CVE-2012-1497
Published: 2012-03-03
Description: The default configuration of Movable Type before 4.38, 5.0x before 5.07, and 5.1x before 5.13 supports the "mt:Include file=" attribute, which allows remote authenticated users to conduct directory traversal attacks and read arbitrary files by leveraging the template-designer role.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://www.debian.org/security/2012/dsa-2423; http://www.movabletype.org/2012/02/movable_type_513_507_and_438_security_updates.html; http://www.movabletype.org/documentation/appendices/release-notes/513.html
CVE: CVE-2011-3031
Published: 2012-03-05
Description: Use-after-free vulnerability in the element wrapper in Google V8, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=105867; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00012.html
CVE: CVE-2011-3032
Published: 2012-03-05
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of SVG values.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=108037; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3033
Published: 2012-03-05
Description: Buffer overflow in Skia, as used in Google Chrome before 17.0.963.65, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://code.google.com/p/chromium/issues/detail?id=108406; http://code.google.com/p/chromium/issues/detail?id=115471; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html
CVE: CVE-2011-3034
Published: 2012-03-05
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving an SVG document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=111748; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3035
Published: 2012-03-05
Description: Use-after-free vulnerability in Google Chrome before 17.0.963.65 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG use elements.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=112212; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html
CVE: CVE-2011-3036
Published: 2012-03-05
Description: Google Chrome before 17.0.963.65 does not properly perform a cast of an unspecified variable during handling of line boxes, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-704
References: http://code.google.com/p/chromium/issues/detail?id=113258; http://googlechromereleases.blogspot.com/2012/03/chrome-stable-update.html; http://lists.apple.com/archives/security-announce/2012/Jul/msg00000.html