deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-2492
Published: 2009-07-17
Description: Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type before 4.261 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2009-2480.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN86472161/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000042.html; http://secunia.com/advisories/35534
CVE: CVE-2009-1897
Published: 2009-07-20
Description: The tun_chr_poll function in drivers/net/tun.c in the tun subsystem in the Linux kernel 2.6.30 and 2.6.30.1, when the -fno-delete-null-pointer-checks gcc option is omitted, allows local users to gain privileges via vectors involving a NULL pointer dereference and an mmap of /dev/net/tun, a different vulnerability than CVE-2009-1894.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0241.html; http://archives.neohapsis.com/archives/fulldisclosure/2009-07/0246.html; http://article.gmane.org/gmane.linux.network/124939
CVE: CVE-2009-2533
Published: 2009-07-20
Description: rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://docs.real.com/docs/security/SecurityUpdate071409HS.pdf; http://osvdb.org/55981; http://www.coresecurity.com/content/real-helix-dna
CVE: CVE-2009-2534
Published: 2009-07-20
Description: RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://docs.real.com/docs/security/SecurityUpdate071409HS.pdf; http://osvdb.org/55982; http://www.coresecurity.com/content/real-helix-dna
CVE: CVE-2009-2535
Published: 2009-07-20
Description: Mozilla Firefox before 2.0.0.19 and 3.x before 3.0.5, SeaMonkey, and Thunderbird allow remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2536
Published: 2009-07-20
Description: Microsoft Internet Explorer 5 through 8 allows remote attackers to cause a denial of service (memory consumption and application crash) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2537
Published: 2009-07-20
Description: KDE Konqueror allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/36057; http://secunia.com/advisories/36062; http://www.exploit-db.com/exploits/9160
CVE: CVE-2009-2538
Published: 2009-07-20
Description: The Nokia N95 running Symbian OS 9.2, N82, and N810 Internet Tablet allow remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2539
Published: 2009-07-20
Description: The Aigo P8860 allows remote attackers to cause a denial of service (memory consumption and browser hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 7.8 (HIGH)
CWE: CWE-189
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2540
Published: 2009-07-20
Description: Opera, possibly 9.64 and earlier, allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-770
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2541
Published: 2009-07-20
Description: The web browser on the Sony PLAYSTATION 3 (PS3) allows remote attackers to cause a denial of service (memory consumption and console hang) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399, CWE-400
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2542
Published: 2009-07-20
Description: Netscape 6 and 8 allows remote attackers to cause a denial of service (memory consumption) via a large integer value for the length property of a Select object, a related issue to CVE-2009-1692.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://www.exploit-db.com/exploits/9160; http://www.g-sec.lu/one-bug-to-rule-them-all.html; http://www.securityfocus.com/archive/1/504969/100/0/threaded
CVE: CVE-2009-2543
Published: 2009-07-20
Description: Multiple unspecified vulnerabilities in the IBM Proventia engine 4.9.0.0.44 20081231, as used in IBM Proventia Network Mail Security System, Network Mail Security System Virtual Appliance, Desktop Endpoint Security, Network Multi-Function Security (MFS), and possibly other products, allow remote attackers to bypass detection of malware via a modified (1) ZIP or (2) CAB archive, a related issue to CVE-2009-1240.
CVSS Score: 10.0 (HIGH)
References: http://iss.custhelp.com/cgi-bin/iss.cfg/php/enduser/std_adp.php?p_faqid=5417; http://www.securityfocus.com/archive/1/504987/100/0/threaded; http://www.securityfocus.com/archive/1/504992/100/0/threaded
CVE: CVE-2009-2544
Published: 2009-07-20
Description: Directory traversal vulnerability in the Marcelo Costa FileServer component 1.0 for Microsoft Windows Live Messenger and Messenger Plus! Live (MPL) allows remote authenticated users to list arbitrary directories and read arbitrary files via a .. (dot dot) in a pathname.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://www.exploit-db.com/exploits/9093; http://www.exploit-db.com/exploits/9093
CVE: CVE-2009-2545
Published: 2009-07-20
Description: SQL injection vulnerability in Advanced Electron Forum (AEF) 1.x, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the filename in an uploaded attachment. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://osvdb.org/55925; http://secunia.com/advisories/35646; https://exchange.xforce.ibmcloud.com/vulnerabilities/51775
CVE: CVE-2009-2546
Published: 2009-07-20
Description: Directory traversal vulnerability in Advanced Electron Forum (AEF) 1.x allows remote attackers to determine the existence of arbitrary files via the avatargalfile parameter when changing an avatar, which leaks the existence of the file in an error message.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55926; http://secunia.com/advisories/35646; https://exchange.xforce.ibmcloud.com/vulnerabilities/51776
CVE: CVE-2009-2547
Published: 2009-07-20
Description: Integer underflow in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) via a VoIP over Network (VON) packet to port 2305 with a negative packet_size value, which triggers a buffer over-read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://aluigi.altervista.org/adv/armadioz-adv.txt; http://secunia.com/advisories/35900; http://www.vupen.com/english/advisories/2009/1951
CVE: CVE-2009-2548
Published: 2009-07-20
Description: Format string vulnerability in Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers in the (1) nickname and (2) datafile fields in a join request, which is not properly handled when logging an error message.
CVSS Score: 10.0 (HIGH)
CWE: CWE-134
References: http://aluigi.altervista.org/adv/armazzofs-adv.txt; http://www.vupen.com/english/advisories/2009/1951; http://aluigi.altervista.org/adv/armazzofs-adv.txt
CVE: CVE-2009-2549
Published: 2009-07-20
Description: Armed Assault (aka ArmA) 1.14 and earlier, and 1.16 beta, and Armed Assault II 1.02 and earlier allows remote attackers to cause a denial of service via a join packet with a final field whose value is (1) 0, which triggers a server crash related to memory allocation, or (2) 1, which triggers CPU/memory consumption and a NULL pointer dereference.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://aluigi.altervista.org/adv/armazzo-adv.txt; http://www.vupen.com/english/advisories/2009/1951; http://aluigi.altervista.org/adv/armazzo-adv.txt
CVE: CVE-2009-2550
Published: 2009-07-20
Description: Stack-based buffer overflow in Hamster Audio Player 0.3a allows remote attackers to execute arbitrary code via a long string in a (1) .m3u or (2) .hpl playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://osvdb.org/55871; http://secunia.com/advisories/35825; http://www.exploit-db.com/exploits/9157
CVE: CVE-2009-2551
Published: 2009-07-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in ScriptsEz Easy Image Downloader allow remote attackers to inject arbitrary web script or HTML via the id parameter in a detail action to (1) main.php and possibly (2) demo_page.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/55862; http://packetstormsecurity.org/0907-exploits/eid-xss.txt; http://secunia.com/advisories/35838
CVE: CVE-2009-2552
Published: 2009-07-20
Description: Multiple directory traversal vulnerabilities in comments.php in Super Simple Blog Script 2.5.4 allow remote attackers to overwrite, include, and execute arbitrary local files via the entry parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/35859; http://www.exploit-db.com/exploits/9179; https://exchange.xforce.ibmcloud.com/vulnerabilities/51805
CVE: CVE-2009-2553
Published: 2009-07-20
Description: Multiple SQL injection vulnerabilities in comments.php in Super Simple Blog Script 2.5.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the entry parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35859; http://www.exploit-db.com/exploits/9180; https://exchange.xforce.ibmcloud.com/vulnerabilities/51806
CVE: CVE-2009-2554
Published: 2009-07-20
Description: SQL injection vulnerability in the search method in jobline.class.php in Jobline (com_jobline) 1.1.2.2, 1.3.1, and possibly earlier versions, a component for Joomla!, allows remote attackers to execute arbitrary SQL commands via the search parameter in a results action to index.php, which invokes the search method from the searchJobPostings function in jobline.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/35877; http://www.exploit-db.com/exploits/9187; http://www.securityfocus.com/bid/35728
CVE: CVE-2009-2555
Published: 2009-07-21
Description: Heap-based buffer overflow in src/jsregexp.cc in Google V8 before 1.1.10.14, as used in Google Chrome before 2.0.172.37, allows remote attackers to execute arbitrary code in the Chrome sandbox via a crafted JavaScript regular expression.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=14719; http://codereview.chromium.org/141042; http://codereview.chromium.org/141042/diff/6/1004
CVE: CVE-2009-2556
Published: 2009-07-21
Description: Google Chrome before 2.0.172.37 allows attackers to leverage renderer access to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger excessive memory allocation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://googlechromereleases.blogspot.com/2009/07/stable-beta-update-bug-fixes.html; http://secunia.com/advisories/35844; http://www.securityfocus.com/bid/35723
CVE: CVE-2009-2557
Published: 2009-07-21
Description: Directory traversal vulnerability in system/download.php in Admin News Tools 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the fichier parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/55856; http://secunia.com/advisories/35842; http://www.exploit-db.com/exploits/9153
CVE: CVE-2009-2558
Published: 2009-07-21
Description: system/message.php in Admin News Tools 2.5 does not properly restrict access, which allows remote attackers to post news messages via a direct request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35842; http://www.exploit-db.com/exploits/9161; https://exchange.xforce.ibmcloud.com/vulnerabilities/51780
CVE: CVE-2009-2559
Published: 2009-07-21
Description: Buffer overflow in the IPMI dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (crash) via unspecified vectors related to an array index error.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/35884; http://www.securityfocus.com/bid/35748; http://www.vupen.com/english/advisories/2009/1970
CVE: CVE-2009-2560
Published: 2009-07-21
Description: Multiple unspecified vulnerabilities in Wireshark 1.2.0 allow remote attackers to cause a denial of service (application crash) via a file that records a malformed packet trace and is processed by the (1) Bluetooth L2CAP, (2) RADIUS, or (3) MIOP dissector. NOTE: it was later reported that the RADIUS issue also affects 0.10.13 through 1.0.9.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/35884; http://secunia.com/advisories/37175; http://secunia.com/advisories/37409
CVE: CVE-2009-2561
Published: 2009-07-21
Description: Unspecified vulnerability in the sFlow dissector in Wireshark 1.2.0 allows remote attackers to cause a denial of service (CPU and memory consumption) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/35884; http://www.securityfocus.com/bid/35748; http://www.vupen.com/english/advisories/2009/1970
CVE: CVE-2009-2562
Published: 2009-07-21
Description: Unspecified vulnerability in the AFS dissector in Wireshark 0.9.2 through 1.2.0 allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://secunia.com/advisories/35884; http://secunia.com/advisories/37477; http://www.debian.org/security/2009/dsa-1942
CVE: CVE-2009-2563
Published: 2009-07-21
Description: Unspecified vulnerability in the Infiniband dissector in Wireshark 1.0.6 through 1.2.0, when running on unspecified platforms, allows remote attackers to cause a denial of service (crash) via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://secunia.com/advisories/35884; http://www.mandriva.com/security/advisories?name=MDVSA-2009:194; http://www.mandriva.com/security/advisories?name=MDVSA-2010:031
CVE: CVE-2009-2564
Published: 2009-07-21
Description: NOS Microsystems getPlus Download Manager, as used in Adobe Reader 1.6.2.36 and possibly other versions, Corel getPlus Download Manager before 1.5.0.48, and possibly other products, installs NOS\bin\getPlus_HelperSvc.exe with insecure permissions (Everyone:Full Control), which allows local users to gain SYSTEM privileges by replacing getPlus_HelperSvc.exe with a Trojan horse program, as demonstrated by use of getPlus Download Manager within Adobe Reader. NOTE: within Adobe Reader, the scope of this issue is limited because the program is deleted and the associated service is not automatically launched after a successful installation and reboot.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://blogs.adobe.com/psirt/2009/07/local_privilege_escalation_in.html; http://retrogod.altervista.org/9sg_adobe_local.html; http://secunia.com/advisories/35930
CVE: CVE-2009-2565
Published: 2009-07-21
Description: Cross-site scripting (XSS) vulnerability in Perl CGI's By Mrs. Shiromuku shiromuku(fs6)DIARY 2.40 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN31110006/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000048.html; http://secunia.com/advisories/35806
CVE: CVE-2009-2566
Published: 2009-07-21
Description: Stack-based buffer overflow in TFM MMPlayer 2.0, and possibly 2.0.0.30, allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/35605; http://www.exploit-db.com/exploits/9047; https://exchange.xforce.ibmcloud.com/vulnerabilities/51442
CVE: CVE-2009-2567
Published: 2009-07-22
Description: SQL injection vulnerability in the Almond Classifieds (com_aclassf) component 5.6.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8619; http://www.securityfocus.com/bid/34843; http://www.exploit-db.com/exploits/8619
CVE: CVE-2009-2568
Published: 2009-07-22
Description: Stack-based buffer overflow in Sorinara Streaming Audio Player (SAP) 0.9 allows remote attackers to execute arbitrary code via a long string in a playlist (.m3u) file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/8617; http://www.exploit-db.com/exploits/8620; http://www.securityfocus.com/bid/34842
CVE: CVE-2009-2569
Published: 2009-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Verlihub Control Panel (VHCP) 1.7e allow remote attackers to inject arbitrary web script or HTML via (1) the nick parameter in a login action to index.php or (2) the URI in a news request to index.html.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstorm.linuxsecurity.com/0905-exploits/verlihub-xss.txt; http://secunia.com/advisories/34941; http://www.securityfocus.com/bid/34856
CVE: CVE-2009-2570
Published: 2009-07-22
Description: Stack-based buffer overflow in the Symantec.FaxViewerControl.1 ActiveX control in WinFax\DCCFAXVW.DLL in Symantec WinFax Pro 10.03 allows remote attackers to execute arbitrary code via a long argument to the AppendFax method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/54137; http://retrogod.altervista.org/9sg_symantec_win_fuck_pro.html; http://secunia.com/advisories/34925
CVE: CVE-2009-2571
Published: 2009-07-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in index.php in VerliAdmin 0.3.7 and 0.3.8 allow remote attackers to inject arbitrary web script or HTML via (1) the URI, (2) the q parameter, (3) the nick parameter, or (4) the nick parameter in a bantest action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.org/0905-exploits/verliadmin-xss.txt; http://www.securityfocus.com/bid/34845; http://www.vupen.com/english/advisories/2009/1265
CVE: CVE-2009-2572
Published: 2009-07-22
Description: Cross-site request forgery (CSRF) vulnerability in the Fivestar module 5.x-1.x before 5.x-1.14 and 6.x-1.x before 6.x-1.14, a module for Drupal, allows remote attackers to hijack the authentication of arbitrary users for requests that cast votes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://drupal.org/node/449026; http://drupal.org/node/449028; http://drupal.org/node/449042
CVE: CVE-2009-2573
Published: 2009-07-22
Description: Multiple SQL injection vulnerabilities in MiniTwitter 0.2 beta, when magic_quotes_gpc is disabled, allow remote authenticated users to execute arbitrary SQL commands via the (1) user parameter to (a) index.php and (b) rss.php.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/8586; http://www.securityfocus.com/archive/1/503155/100/0/threaded; http://www.securityfocus.com/bid/34795
CVE: CVE-2009-2574
Published: 2009-07-22
Description: index.php in MiniTwitter 0.2 beta allows remote authenticated users to modify certain options of arbitrary accounts via an opt action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www.exploit-db.com/exploits/8587; http://www.securityfocus.com/archive/1/503157/100/0/threaded; http://www.securityfocus.com/bid/34795
CVE: CVE-2009-2462
Published: 2009-07-22
Description: The browser engine in Mozilla Firefox before 3.0.12 and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to (1) the frame chain and synchronous events, (2) a SetMayHaveFrame assertion and nsCSSFrameConstructor::CreateFloatingLetterFrame, (3) nsCSSFrameConstructor::ConstructFrame, (4) the child list and initial reflow, (5) GetLastSpecialSibling, (6) nsFrameManager::GetPrimaryFrameFor and MathML, (7) nsFrame::GetBoxAscent, (8) nsCSSFrameConstructor::AdjustParentFrame, (9) nsDOMOfflineResourceList, and (10) nsContentUtils::ComparePosition.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html
CVE: CVE-2009-2463
Published: 2009-07-22
Description: Multiple integer overflows in the (1) PL_Base64Decode and (2) PL_Base64Encode functions in nsprpub/lib/libc/src/base64.c in Mozilla Firefox before 3.0.12, Thunderbird before 2.0.0.24, and SeaMonkey before 1.1.19 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors that trigger buffer overflows.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html
CVE: CVE-2009-2464
Published: 2009-07-22
Description: The nsXULTemplateQueryProcessorRDF::CheckIsSeparator function in Mozilla Firefox before 3.0.12, SeaMonkey 2.0a1pre, and Thunderbird allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to loading multiple RDF files in a XUL tree element.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2009-08/msg00002.html; http://rhn.redhat.com/errata/RHSA-2009-1162.html