deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-6330
Published: 2013-01-04
Description: The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://sourceforge.net/mailarchive/message.php?msg_id=30219695; http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329; http://www.securityfocus.com/bid/56950
CVE: CVE-2012-6348
Published: 2013-01-04
Description: Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwrite arbitrary files via a symlink attack on the adcheckDMoutput temporary file, or (2) overwrite arbitrary files and consequently gain privileges via a symlink attack on the centrify.cmd.0 temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0036.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0037.html; http://archives.neohapsis.com/archives/bugtraq/2012-12/0071.html
CVE: CVE-2011-4316
Published: 2013-01-04
Description: Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors.
CVSS Score: 3.7 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1506.html; http://rhn.redhat.com/errata/RHSA-2012-1508.html; http://www.securityfocus.com/bid/56825
CVE: CVE-2012-0860
Published: 2013-01-04
Description: Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse (1) deployUtil.py or (2) vds_bootstrap.py Python module in /tmp/.
CVSS Score: 6.2 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2012-1506.html; http://rhn.redhat.com/errata/RHSA-2012-1508.html; http://www.securityfocus.com/bid/56825
CVE: CVE-2012-0861
Published: 2013-01-04
Description: The vds_installer in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vds_bootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via a man-in-the-middle attack.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://rhn.redhat.com/errata/RHSA-2012-1505.html; http://rhn.redhat.com/errata/RHSA-2012-1506.html; http://rhn.redhat.com/errata/RHSA-2012-1508.html
CVE: CVE-2012-2696
Published: 2013-01-04
Description: The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request.
CVSS Score: 2.7 (LOW)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1506.html; http://www.securityfocus.com/bid/56825; http://www.securitytracker.com/id?1027838
CVE: CVE-2012-3538
Published: 2013-01-04
Description: Pulp in Red Hat CloudForms before 1.1 logs administrative passwords in a world-readable file, which allows local users to read pulp administrative passwords by reading production.log.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: http://osvdb.org/88139; http://rhn.redhat.com/errata/RHSA-2012-1543.html; http://secunia.com/advisories/51472
CVE: CVE-2012-4543
Published: 2013-01-04
Description: Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize to the displayCRL script, or (3) nonce variable to the profileProcess script.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2012-1550.html; http://rhn.redhat.com/errata/RHSA-2013-0511.html; http://secunia.com/advisories/51482
CVE: CVE-2012-4555
Published: 2013-01-04
Description: The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 does not properly handle interruptions of token format operations, which allows remote attackers to cause a denial of service (NULL pointer dereference and Apache httpd web server child process crash) via unspecified vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://rhn.redhat.com/errata/RHSA-2012-1550.html; http://secunia.com/advisories/51482; http://www.securityfocus.com/bid/56843
CVE: CVE-2012-4556
Published: 2013-01-04
Description: The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2012-1550.html; http://secunia.com/advisories/51482; http://www.securityfocus.com/bid/56843
CVE: CVE-2012-4574
Published: 2013-01-04
Description: Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions for pulp.conf, which allows local users to read the administrative password by reading this file.
CVSS Score: 2.1 (LOW)
CWE: CWE-255
References: http://osvdb.org/88138; http://rhn.redhat.com/errata/RHSA-2012-1543.html; http://secunia.com/advisories/51472
CVE: CVE-2012-5516
Published: 2013-01-04
Description: Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://rhn.redhat.com/errata/RHSA-2012-1506.html; http://www.securityfocus.com/bid/56825; http://www.securitytracker.com/id?1027838
CVE: CVE-2012-5581
Published: 2013-01-04
Description: Stack-based buffer overflow in tif_dir.c in LibTIFF before 4.0.2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DOTRANGE tag in a TIFF image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-updates/2013-01/msg00076.html; http://rhn.redhat.com/errata/RHSA-2012-1590.html; http://secunia.com/advisories/51491
CVE: CVE-2012-5603
Published: 2013-01-04
Description: proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://osvdb.org/88140; http://osvdb.org/88142; http://rhn.redhat.com/errata/RHSA-2012-1543.html
CVE: CVE-2012-5605
Published: 2013-01-04
Description: Grinder in Red Hat CloudForms before 1.1 uses world-writable permissions for /var/lib/pulp/cache/grinder/, which allows local users to modify grinder cache files.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://osvdb.org/88141; http://rhn.redhat.com/errata/RHSA-2012-1543.html; http://secunia.com/advisories/51472
CVE: CVE-2011-3937
Published: 2013-01-05
Description: The H.263 codec (libavcodec/h263dec.c) in FFmpeg 0.7.x before 0.7.12, 0.8.x before 0.8.11, and unspecified versions before 0.10, and in Libav 0.5.x before 0.5.9, 0.6.x before 0.6.6, 0.7.x before 0.7.5, and 0.8.x before 0.8.1 has unspecified impact and attack vectors related to "width/height changing with frame threads."
CVSS Score: 10.0 (HIGH)
References: http://ffmpeg.org/security.html; http://git.libav.org/?p=libav.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba; http://git.videolan.org/?p=ffmpeg.git%3Ba=commit%3Bh=71db86d53b5c6872cea31bf714a1a38ec78feaba
CVE: CVE-2012-2378
Published: 2013-01-05
Description: Apache CXF 2.4.5 through 2.4.7, 2.5.1 through 2.5.3, and 2.6.x before 2.6.1, does not properly enforce child policies of a WS-SecurityPolicy 1.1 SupportingToken policy on the client side, which allows remote attackers to bypass the (1) AlgorithmSuite, (2) SignedParts, (3) SignedElements, (4) EncryptedParts, and (5) EncryptedElements policies.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://cxf.apache.org/cve-2012-2378.html; http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html
CVE: CVE-2012-4549
Published: 2013-01-05
Description: The processInvocation function in org.jboss.as.ejb3.security.AuthorizationInterceptor in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, authorizes all requests when no roles are allowed for an Enterprise Java Beans (EJB) method invocation, which allows attackers to bypass intended access restrictions for EJB methods.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html; http://rhn.redhat.com/errata/RHSA-2012-1594.html
CVE: CVE-2012-4550
Published: 2013-01-05
Description: JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) before 6.0.1, when using role-based authorization for Enterprise Java Beans (EJB) access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to the EJB.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://rhn.redhat.com/errata/RHSA-2012-1591.html; http://rhn.redhat.com/errata/RHSA-2012-1592.html; http://rhn.redhat.com/errata/RHSA-2012-1594.html
CVE: CVE-2012-6498
Published: 2013-01-08
Description: Unrestricted file upload vulnerability in index.php in Atomymaxsite 2.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file, as exploited in the wild in October 2012.
CVSS Score: 6.8 (MEDIUM)
References: http://thaicert.or.th/alerts/admin/2012/al2012ad025.html; http://www.youtube.com/watch?v=CfvTCSS3LGY; http://thaicert.or.th/alerts/admin/2012/al2012ad025.html
CVE: CVE-2013-0625
Published: 2013-01-09
Description: Adobe ColdFusion 9.0, 9.0.1, and 9.0.2, when a password is not configured, allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors, as exploited in the wild in January 2013.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287, CWE-287
References: http://www.adobe.com/support/security/advisories/apsa13-01.html; http://www.adobe.com/support/security/bulletins/apsb13-03.html; http://www.securityfocus.com/bid/57164
CVE: CVE-2013-0629
Published: 2013-01-09
Description: Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vectors, as exploited in the wild in January 2013.
CVSS Score: 7.5 (HIGH)
References: http://www.adobe.com/support/security/advisories/apsa13-01.html; http://www.adobe.com/support/security/bulletins/apsb13-03.html; http://www.securityfocus.com/bid/57165
CVE: CVE-2013-0631
Published: 2013-01-09
Description: Adobe ColdFusion 9.0, 9.0.1, and 9.0.2 allows attackers to obtain sensitive information via unspecified vectors, as exploited in the wild in January 2013.
CVSS Score: 7.5 (HIGH)
References: http://www.adobe.com/support/security/advisories/apsa13-01.html; http://www.adobe.com/support/security/bulletins/apsb13-03.html; http://www.adobe.com/support/security/advisories/apsa13-01.html
CVE: CVE-2013-0001
Published: 2013-01-09
Description: The Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 4, and 4.5 does not properly initialize memory arrays, which allows remote attackers to obtain sensitive information via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a pointer to an unmanaged memory location, aka "System Drawing Information Disclosure Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15814; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004
CVE: CVE-2013-0002
Published: 2013-01-09
Description: Buffer overflow in the Windows Forms (aka WinForms) component in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages improper counting of objects during a memory copy operation, aka "WinForms Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004; https://lists.apache.org/thread.html/680e6938b6412e26d5446054fd31de2011d33af11786b989127d1cc3%40%3Ccommits.santuario.apache.org%3E
CVE: CVE-2013-0003
Published: 2013-01-09
Description: Buffer overflow in a System.DirectoryServices.Protocols (S.DS.P) namespace method in Microsoft .NET Framework 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a missing array-size check during a memory copy operation, aka "S.DS.P Buffer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16381
CVE: CVE-2013-0004
Published: 2013-01-09
Description: Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.0 SP2, 3.5, 3.5.1, 4, and 4.5 does not properly validate the permissions of objects in memory, which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application, aka "Double Construction Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-004; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16339
CVE: CVE-2013-0005
Published: 2013-01-09
Description: The WCF Replace function in the Open Data (aka OData) protocol implementation in Microsoft .NET Framework 3.5, 3.5 SP1, 3.5.1, and 4, and the Management OData IIS Extension on Windows Server 2012, allows remote attackers to cause a denial of service (resource consumption and daemon restart) via crafted values in HTTP requests, aka "Replace Denial of Service Vulnerability."
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-007; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16282
CVE: CVE-2013-0006
Published: 2013-01-09
Description: Microsoft XML Core Services (aka MSXML) 3.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML Integer Truncation Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-189
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16429
CVE: CVE-2013-0007
Published: 2013-01-09
Description: Microsoft XML Core Services (aka MSXML) 4.0, 5.0, and 6.0 does not properly parse XML content, which allows remote attackers to execute arbitrary code via a crafted web page, aka "MSXML XSLT Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-002; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15458
CVE: CVE-2013-0008
Published: 2013-01-09
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle window broadcast messages, which allows local users to gain privileges via a crafted application, aka "Win32k Improper Message Handling Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/24485; http://www.securityfocus.com/bid/57135; http://www.us-cert.gov/cas/techalerts/TA13-008A.html
CVE: CVE-2013-0009
Published: 2013-01-09
Description: Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0010.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-003; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A15760
CVE: CVE-2013-0010
Published: 2013-01-09
Description: Cross-site scripting (XSS) vulnerability in Microsoft System Center Operations Manager 2007 SP1 and R2 allows remote attackers to inject arbitrary web script or HTML via crafted input, aka "System Center Operations Manager Web Console XSS Vulnerability," a different vulnerability than CVE-2013-0009.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-003; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16232
CVE: CVE-2013-0011
Published: 2013-01-09
Description: The Print Spooler in Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted print job, aka "Windows Print Spooler Components Vulnerability."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-001; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16357
CVE: CVE-2013-0013
Published: 2013-01-09
Description: The SSL provider component in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT does not properly handle encrypted packets, which allows man-in-the-middle attackers to conduct SSLv2 downgrade attacks against (1) SSLv3 sessions or (2) TLS sessions by intercepting handshakes and injecting content, aka "Microsoft SSL Version 3 and TLS Protocol Security Feature Bypass Vulnerability."
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.us-cert.gov/cas/techalerts/TA13-008A.html; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-006; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16273
CVE: CVE-2012-1530
Published: 2013-01-10
Description: Heap-based buffer overflow in the XSLT engine in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a PDF file containing an XSL file that triggers memory corruption when the lang function processes XML data with a crafted node-set.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0601
Published: 2013-01-10
Description: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0605, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0602
Published: 2013-01-10
Description: Use-after-free vulnerability in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0603
Published: 2013-01-10
Description: Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0604.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0604
Published: 2013-01-10
Description: Heap-based buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0603.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0605
Published: 2013-01-10
Description: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-1530, CVE-2013-0601, CVE-2013-0616, CVE-2013-0619, CVE-2013-0620, and CVE-2013-0623.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0606
Published: 2013-01-10
Description: Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-0612, CVE-2013-0615, CVE-2013-0617, and CVE-2013-0621.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html
CVE: CVE-2013-0607
Published: 2013-01-10
Description: Adobe Reader and Acrobat 9.x before 9.5.3, 10.x before 10.1.5, and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors, related to a "logic error," a different vulnerability than CVE-2013-0608, CVE-2013-0611, CVE-2013-0614, and CVE-2013-0618.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00005.html; http://lists.opensuse.org/opensuse-updates/2013-01/msg00028.html