deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-4689
Published: 2011-12-07
Description: Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.coredump.cx/cachetime/; http://secunia.com/advisories/47129; http://lcamtuf.coredump.cx/cachetime/
CVE: CVE-2011-4690
Published: 2011-12-07
Description: Opera 11.60 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.coredump.cx/cachetime/; http://secunia.com/advisories/47128; http://lcamtuf.coredump.cx/cachetime/
CVE: CVE-2011-4691
Published: 2011-12-07
Description: Google Chrome 15.0.874.121 and earlier does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.coredump.cx/cachetime/; http://secunia.com/advisories/47127; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14188
CVE: CVE-2011-4692
Published: 2011-12-07
Description: WebKit, as used in Apple Safari 5.1.1 and earlier and Google Chrome 15 and earlier, does not prevent capture of data about the time required for image loading, which makes it easier for remote attackers to determine whether an image exists in the browser cache via crafted JavaScript code, as demonstrated by visipisi.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://lcamtuf.coredump.cx/cachetime/; http://oxplot.github.com/visipisi/visipisi.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14098
CVE: CVE-2011-4693
Published: 2011-12-07
Description: Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the first of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA).  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
References: http://partners.immunityinc.com/movies/VulnDisco-Flash0day-v2.mov; http://www.securitytracker.com/id?1026392; https://bugzilla.redhat.com/show_bug.cgi?id=761216
CVE: CVE-2011-4694
Published: 2011-12-07
Description: Unspecified vulnerability in Adobe Flash Player 11.1.102.55 on Windows and Mac OS X allows remote attackers to execute arbitrary code via a crafted SWF file, as demonstrated by the second of two vulnerabilities exploited by the Intevydis vd_adobe_fp module in VulnDisco Step Ahead (SA).  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 9.3 (HIGH)
References: http://partners.immunityinc.com/movies/VulnDisco-Flash0day-v2.mov; http://www.securitytracker.com/id?1026392; https://bugzilla.redhat.com/show_bug.cgi?id=761223
CVE: CVE-2011-4695
Published: 2011-12-07
Description: Unspecified vulnerability in Microsoft Windows 7 SP1, when Java is installed, allows local users to bypass Internet Explorer sandbox restrictions and gain privileges via unknown vectors, as demonstrated by the White Phosphorus wp_ie_sandbox_escape module for Immunity CANVAS.  NOTE: as of 20111207, this disclosure has no actionable information. However, because the module author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes.
CVSS Score: 6.9 (MEDIUM)
References: http://partners.immunityinc.com/movies/VulnDisco-Flash0day-v2.mov; https://lists.immunityinc.com/pipermail/dailydave/2011-December/000402.html; http://partners.immunityinc.com/movies/VulnDisco-Flash0day-v2.mov
CVE: CVE-2011-2653
Published: 2011-12-08
Description: Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
CVSS Score: 10.0 (HIGH)
CWE: CWE-22
References: http://download.novell.com/Download?buildid=hPvHtXeNmCU~; http://zerodayinitiative.com/advisories/ZDI-11-342/; http://download.novell.com/Download?buildid=hPvHtXeNmCU~
CVE: CVE-2011-3179
Published: 2011-12-08
Description: The server process in Novell Messenger 2.1 and 2.2.x before 2.2.1, and Novell GroupWise Messenger 2.04 and earlier, allows remote attackers to read from arbitrary memory locations via a crafted command.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://www.novell.com/support/viewContent.do?externalId=7009634; https://bugzilla.novell.com/show_bug.cgi?id=712158; http://www.novell.com/support/viewContent.do?externalId=7009634
CVE: CVE-2011-3636
Published: 2011-12-08
Description: Cross-site request forgery (CSRF) vulnerability in the management interface in FreeIPA before 2.1.4 allows remote attackers to hijack the authentication of administrators for requests that make configuration changes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://freeipa.org/page/IPAv2_214; http://freeipa.org/page/IPAv2_214
CVE: CVE-2011-4054
Published: 2011-12-08
Description: Cross-site scripting (XSS) vulnerability in login.fcc in CA SiteMinder R6 SP6 before CR7 and R12 SP3 before CR8 allows remote attackers to inject arbitrary web script or HTML via the postpreservationdata parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/713012; http://www.kb.cert.org/vuls/id/MAPG-8MCH2B; http://www.kb.cert.org/vuls/id/713012
CVE: CVE-2011-4264
Published: 2011-12-08
Description: Cross-site scripting (XSS) vulnerability in Etomite before 1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN04329324/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000101; http://jvn.jp/en/jp/JVN04329324/index.html
CVE: CVE-2011-4265
Published: 2011-12-08
Description: Cross-site scripting (XSS) vulnerability in phpWebSite before 1.0.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN70502960/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000103; http://jvn.jp/en/jp/JVN70502960/index.html
CVE: CVE-2011-4539
Published: 2011-12-08
Description: dhcpd in ISC DHCP 4.x before 4.2.3-P1 and 4.1-ESV before 4.1-ESV-R4 does not properly handle regular expressions in dhcpd.conf, which allows remote attackers to cause a denial of service (daemon crash) via a crafted request packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070980.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-January/071549.html; http://lists.opensuse.org/opensuse-updates/2011-12/msg00006.html
CVE: CVE-2011-2917
Published: 2011-12-08
Description: SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the zorder parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18110; http://www.openwall.com/lists/oss-security/2011/08/12/6; http://www.osvdb.org/74502
CVE: CVE-2011-4707
Published: 2011-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://dsecrg.com/pages/vul/show.php?id=336; http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a; http://www.securityfocus.com/archive/1/520554/100/0/threaded
CVE: CVE-2011-4708
Published: 2011-12-08
Description: Cross-site scripting (XSS) vulnerability in IBM Rational Asset Manager before 7.5.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM38467; http://www.securitytracker.com/id?1026285; http://www-01.ibm.com/support/docview.wss?uid=swg1PM38467
CVE: CVE-2011-4709
Published: 2011-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php, or the (2) return and (3) search parameters to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/46842; http://www.osvdb.org/77095; http://www.zeroscience.mk/codes/hotarucms_xss.txt
CVE: CVE-2011-4710
Published: 2011-12-08
Description: Multiple SQL injection vulnerabilities in Pixie CMS 1.01 through 1.04 allow remote attackers to execute arbitrary SQL commands via the (1) pixie_user parameter and (2) Referer HTTP header in a request to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/18115; http://www.exploit-db.com/exploits/18115
CVE: CVE-2011-4711
Published: 2011-12-08
Description: Multiple directory traversal vulnerabilities in namazu.cgi in Namazu before 2.0.16 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) lang or (2) result parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.namazu.org/security.html#; https://exchange.xforce.ibmcloud.com/vulnerabilities/71489; http://www.namazu.org/security.html#
CVE: CVE-2011-4712
Published: 2011-12-08
Description: Directory traversal vulnerability in Oxide WebServer allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in an HTTP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/archive/1/520679/100/0/threaded; http://www.securityfocus.com/bid/50845; https://exchange.xforce.ibmcloud.com/vulnerabilities/71512
CVE: CVE-2011-4713
Published: 2011-12-08
Description: Directory traversal vulnerability in catalog/content.php in osCSS2 2.1.0 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the _ID parameter to (1) catalog/shopping_cart.php or (2) catalog/content.php.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://forums.oscss.org/2-security/oscss2-id-parameter-local-file-inclusion-t1999.html#p11194; http://oscss.svn.sourceforge.net/viewvc/oscss?view=revision&revision=3872; http://seclists.org/fulldisclosure/2011/Nov/117
CVE: CVE-2011-4714
Published: 2011-12-08
Description: Directory traversal vulnerability in Virtual Vertex Muster before 6.20 allows remote attackers to read arbitrary files via a \.. (backslash dot dot) in the URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/77375; http://secunia.com/advisories/46991; http://www.exploit-db.com/exploits/18185
CVE: CVE-2011-4715
Published: 2011-12-08
Description: Directory traversal vulnerability in cgi-bin/koha/mainpage.pl in Koha 3.4 before 3.4.7 and 3.6 before 3.6.1, and LibLime Koha 4.2 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the KohaOpacLanguage cookie to cgi-bin/opac/opac-main.pl, related to Output.pm.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://koha-community.org/koha-3-4-7/#more-2971; http://koha-community.org/koha-3-6-1/#more-2929; http://osvdb.org/77322
CVE: CVE-2011-4716
Published: 2011-12-08
Description: Directory traversal vulnerability in file in DreamBox DM800 1.6rc3, 1.5rc1, and earlier allows remote attackers to read arbitrary files via the file parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/18079; http://www.securityfocus.com/bid/50520; http://www.exploit-db.com/exploits/18079
CVE: CVE-2011-0291
Published: 2011-12-08
Description: The BlackBerry PlayBook service on the Research In Motion (RIM) BlackBerry PlayBook tablet with software before 1.0.8.6067 allows local users to gain privileges via a crafted configuration file in a backup archive.
CVSS Score: 7.2 (HIGH)
CWE: CWE-200
References: http://blackberry.com/btsc/KB29191; http://secunia.com/advisories/47132; http://securitytracker.com/id?1026386
CVE: CVE-2011-1530
Published: 2011-12-08
Description: The process_tgs_req function in do_tgs_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.9 through 1.9.2 allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted TGS request that triggers an error other than the KRB5_KDB_NOENTRY error.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/47124; http://securitytracker.com/id?1026374; http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-007.txt
CVE: CVE-2011-4128
Published: 2011-12-08
Description: Buffer overflow in the gnutls_session_get_data function in lib/gnutls_session.c in GnuTLS 2.12.x before 2.12.14 and 3.x before 3.0.7, when used on a client that performs nonstandard session resumption, allows remote TLS servers to cause a denial of service (application crash) via a large SessionTicket.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/5596; http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=190cef6eed37d0e73a73c1e205eb31d45ab60a3c; http://git.savannah.gnu.org/gitweb/?p=gnutls.git%3Ba=commitdiff%3Bh=e82ef4545e9e98cbcb032f55d7c750b81e3a0450
CVE: CVE-2011-4315
Published: 2011-12-08
Description: Heap-based buffer overflow in compression-pointer processing in core/ngx_resolver.c in nginx before 1.0.10 allows remote resolvers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long response.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-787
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070569.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00005.html; http://openwall.com/lists/oss-security/2011/11/17/10
CVE: CVE-2011-4719
Published: 2011-12-09
Description: Multiple unspecified vulnerabilities in Google Chrome before 16.0.912.63 on the Acer AC700, Samsung Series 5, and Cr-48 Chromebook platforms have unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://googlechromereleases.blogspot.com/2011/12/beta-channel-update-for-chromebooks.html; http://googlechromereleases.blogspot.com/2011/12/beta-channel-update-for-chromebooks.html
CVE: CVE-2011-4346
Published: 2011-12-10
Description: Cross-site scripting (XSS) vulnerability in the web interface in Red Hat Network (RHN) Satellite 5.4.1 allows remote authenticated users to inject arbitrary web script or HTML via the Description field of the asset tag in a Custom Info page.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://secunia.com/advisories/47162; http://www.redhat.com/support/errata/RHSA-2011-1794.html; http://www.securityfocus.com/bid/50963
CVE: CVE-2011-4349
Published: 2011-12-10
Description: Multiple SQL injection vulnerabilities in (1) cd-mapping-db.c and (2) cd-device-db.c in colord before 0.1.15 allow local users to execute arbitrary SQL commands via vectors related to color devices and (a) device id, (b) property, or (c) profile id.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-89
References: http://gitorious.org/colord/master/commit/1fadd90afcb4bbc47513466ee9bb1e4a8632ac3b; http://gitorious.org/colord/master/commit/36549e0ed255e7dfa7852d08a75dd5f00cbd270e; http://lists.fedoraproject.org/pipermail/package-announce/2011-December/070450.html
CVE: CVE-2011-4357
Published: 2011-12-10
Description: Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://code.google.com/p/clearsilver/source/detail?r=919; http://osvdb.org/77419; http://secunia.com/advisories/47016
CVE: CVE-2011-3633
Published: 2011-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4062.  Reason: This candidate is a duplicate of CVE-2011-4062.  Notes: All CVE users should reference CVE-2011-4062 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-1161
Published: 2011-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1160, CVE-2011-1162.  Reason: This candidate was withdrawn by its CNA. Further investigation showed that only two candidates, CVE-2011-1160 and CVE-2011-1162, were needed for the set of security issues in question.  Notes: none
CVE: CVE-2011-4323
Published: 2011-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-2726.  Reason: This candidate is a duplicate of CVE-2011-2726.  Notes: All CVE users should reference CVE-2011-2726 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4359
Published: 2011-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-4343.  Reason: This candidate is a duplicate of CVE-2011-4343.  Notes: All CVE users should reference CVE-2011-4343 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-4201
Published: 2011-12-13
Description: remote_support.cgi in the Tadasoft Restorepoint 3.2 evaluation image allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) pid1 or (2) pid2 parameter in a stop_remote_support action.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: https://www.trustmatta.com/advisories/MATTA-2011-003.txt; https://www.trustmatta.com/advisories/MATTA-2011-003.txt
CVE: CVE-2011-4202
Published: 2011-12-13
Description: The Tadasoft Restorepoint 3.2 evaluation image uses weak permissions (www write access) for unspecified scripts, which allows local users to gain privileges by modifying a script file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: https://www.trustmatta.com/advisories/MATTA-2011-003.txt; https://www.trustmatta.com/advisories/MATTA-2011-003.txt
CVE: CVE-2011-4266
Published: 2011-12-13
Description: Untrusted search path vulnerability in FFFTP before 1.98d allows local users to gain privileges via a Trojan horse executable file in a directory that is accessed for reading an extensionless file, as demonstrated by executing the README.exe file when a user attempts to access the README file, a different vulnerability than CVE-2011-3991.
CVSS Score: 9.3 (HIGH)
References: http://jvn.jp/en/jp/JVN94002296/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000104; http://sourceforge.jp/projects/ffftp/wiki/Security
CVE: CVE-2011-3903
Published: 2011-12-13
Description: Google Chrome before 16.0.912.63 does not properly perform regex matching, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-697
References: http://code.google.com/p/chromium/issues/detail?id=81753; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14704
CVE: CVE-2011-3904
Published: 2011-12-13
Description: Use-after-free vulnerability in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to bidirectional text (aka bidi) handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=107258; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://bugs.webkit.org/show_bug.cgi?id=66015
CVE: CVE-2011-3905
Published: 2011-12-13
Description: libxml2, as used in Google Chrome before 16.0.912.63, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=95465; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; http://rhn.redhat.com/errata/RHSA-2013-0217.html
CVE: CVE-2011-3906
Published: 2011-12-13
Description: The PDF parser in Google Chrome before 16.0.912.63 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=98809; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14548
CVE: CVE-2011-3907
Published: 2011-12-13
Description: The view-source feature in Google Chrome before 16.0.912.63 allows remote attackers to spoof the URL bar via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=99016; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14299
CVE: CVE-2011-3908
Published: 2011-12-13
Description: Google Chrome before 16.0.912.63 does not properly parse SVG documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=100863; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html
CVE: CVE-2011-3909
Published: 2011-12-13
Description: The Cascading Style Sheets (CSS) implementation in Google Chrome before 16.0.912.63 on 64-bit platforms does not properly manage property arrays, which allows remote attackers to cause a denial of service (memory corruption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=101010; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; http://lists.apple.com/archives/security-announce/2012/Mar/msg00000.html
CVE: CVE-2011-3910
Published: 2011-12-13
Description: Google Chrome before 16.0.912.63 does not properly handle YUV video frames, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=101494; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14517
CVE: CVE-2011-3911
Published: 2011-12-13
Description: Google Chrome before 16.0.912.63 does not properly handle PDF documents, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-125
References: http://code.google.com/p/chromium/issues/detail?id=101779; http://googlechromereleases.blogspot.com/2011/12/stable-channel-update.html; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14683