deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-4768
Published: 2011-03-18
Description: Open Ticket Request System (OTRS) before 2.3.5 does not properly disable hidden permissions, which allows remote authenticated users to bypass intended queue access restrictions in opportunistic circumstances by visiting a ticket, related to a certain ordering of permission-set and permission-remove operations involving both hidden permissions and other permissions.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-264
References: http://bugs.otrs.org/show_bug.cgi?id=3499; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; http://bugs.otrs.org/show_bug.cgi?id=3499
CVE: CVE-2011-1433
Published: 2011-03-18
Description: The (1) AgentInterface and (2) CustomerInterface components in Open Ticket Request System (OTRS) before 3.0.6 place cleartext credentials into the session data in the database, which makes it easier for context-dependent attackers to obtain sensitive information by reading the _UserLogin and _UserPW fields.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://bugs.otrs.org/show_bug.cgi?id=6878; http://source.otrs.org/viewvc.cgi/otrs/CHANGES?revision=1.1807; https://exchange.xforce.ibmcloud.com/vulnerabilities/66196
CVE: CVE-2011-0284
Published: 2011-03-20
Description: Double free vulnerability in the prepare_error_as function in do_as_req.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 through 1.9, when the PKINIT feature is enabled, allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via an e_data field containing typed data.
CVSS Score: 7.6 (HIGH)
CWE: CWE-399
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056413.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056573.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056579.html
CVE: CVE-2011-0421
Published: 2011-03-20
Description: The _zip_name_locate function in zip_name_locate.c in the Zip extension in PHP before 5.3.6 does not properly handle a ZIPARCHIVE::FL_UNCHANGED argument, which might allow context-dependent attackers to cause a denial of service (NULL pointer dereference) via an empty ZIP archive that is processed with a (1) locateName or (2) statName operation.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.php.net/bug.php?id=53885; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
CVE: CVE-2011-0708
Published: 2011-03-20
Description: exif.c in the Exif extension in PHP before 5.3.6 on 64-bit platforms performs an incorrect cast, which allows remote attackers to cause a denial of service (application crash) via an image with a crafted Image File Directory (IFD) that triggers a buffer over-read.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.php.net/bug.php?id=54002; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057709.html
CVE: CVE-2011-1024
Published: 2011-03-20
Description: chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735; http://openwall.com/lists/oss-security/2011/02/24/12
CVE: CVE-2011-1025
Published: 2011-03-20
Description: bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://openwall.com/lists/oss-security/2011/02/24/12; http://openwall.com/lists/oss-security/2011/02/25/13
CVE: CVE-2011-1027
Published: 2011-03-20
Description: Off-by-one error in the convert_query_hexchar function in html.c in cgit.cgi in cgit before 0.8.3.5 allows remote attackers to cause a denial of service (infinite loop) via a string composed of a % (percent) character followed by invalid hex characters, as demonstrated by a %gg sequence.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-193
References: http://article.gmane.org/gmane.comp.version-control.git/168493; http://hjemli.net/git/cgit/commit/?h=stable&id=fc384b16fb[PII_REDACTED]000d3cea2d53fccc548e; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055896.html
CVE: CVE-2011-1081
Published: 2011-03-20
Description: modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://openwall.com/lists/oss-security/2011/02/28/1; http://openwall.com/lists/oss-security/2011/02/28/2
CVE: CVE-2011-1464
Published: 2011-03-20
Description: Buffer overflow in the strval function in PHP before 5.3.6, when the precision configuration option has a large value, might allow context-dependent attackers to cause a denial of service (application crash) via a small numerical value in the argument.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://bugs.php.net/bug.php?id=54055; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2507&w=2; http://www.mandriva.com/security/advisories?name=MDVSA-2011:052
CVE: CVE-2011-1465
Published: 2011-03-20
Description: The SPDY implementation in net/http/http_network_transaction.cc in Google Chrome before 11.0.696.14 drains the bodies from SPDY responses, which might allow remote SPDY servers to cause a denial of service (application exit) by canceling a stream.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=75657; http://googlechromereleases.blogspot.com/2011/03/dev-channel-update_17.html; http://src.chromium.org/viewvc/chrome/trunk/src/net/http/http_network_transaction.cc?r1=77893&r2=77892&pathrev=77893
CVE: CVE-2011-1466
Published: 2011-03-20
Description: Integer overflow in the SdnToJulian function in the Calendar extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a large integer in the first argument to the cal_from_jd function.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://bugs.php.net/bug.php?id=53574; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-03/msg00016.html
CVE: CVE-2011-1467
Published: 2011-03-20
Description: Unspecified vulnerability in the NumberFormatter::setSymbol (aka numfmt_set_symbol) function in the Intl extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via an invalid argument, a related issue to CVE-2010-4409.
CVSS Score: 5.0 (MEDIUM)
References: http://bugs.php.net/bug.php?id=53512; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-1468
Published: 2011-03-20
Description: Multiple memory leaks in the OpenSSL extension in PHP before 5.3.6 might allow remote attackers to cause a denial of service (memory consumption) via (1) plaintext data to the openssl_encrypt function or (2) ciphertext data to the openssl_decrypt function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-399
References: http://bugs.php.net/bug.php?id=54060; http://bugs.php.net/bug.php?id=54061; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
CVE: CVE-2011-1469
Published: 2011-03-20
Description: Unspecified vulnerability in the Streams component in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) by accessing an ftp:// URL during use of an HTTP proxy with the FTP wrapper.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.php.net/bug.php?id=54092; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-1470
Published: 2011-03-20
Description: The Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (application crash) via a ziparchive stream that is not properly handled by the stream_get_contents function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://bugs.php.net/bug.php?id=53579; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://support.apple.com/kb/HT5002
CVE: CVE-2011-1471
Published: 2011-03-20
Description: Integer signedness error in zip_stream.c in the Zip extension in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (CPU consumption) via a malformed archive file that triggers errors in zip_fread function calls.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://bugs.php.net/bug.php?id=49072; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://support.apple.com/kb/HT5002
CVE: CVE-2008-7284
Published: 2011-03-22
Description: IBM Lotus Quickr 8.1 before 8100.003 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by clicking a download link, aka SPR QCAO7E6AM8.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2008-7285
Published: 2011-03-22
Description: Unspecified vulnerability in the docnote string handling implementation in IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino allows remote attackers to cause a denial of service (daemon crash) via unknown vectors, aka SPR JFLD7GZT25.
CVSS Score: 5.0 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2008-7286
Published: 2011-03-22
Description: IBM Lotus Quickr 8.1 before 8.1.0.2 services for Lotus Domino does not properly handle URLs that request images, which allows remote authenticated users to cause a denial of service (daemon crash) via a request to resources.nsf, aka SPR XFXF7JDBCX.
CVSS Score: 3.5 (LOW)
CWE: CWE-20
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2009-5058
Published: 2011-03-22
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.5 services for Lotus Domino allows remote authenticated users to cause a denial of service (daemon crash) by deleting an item that is accessed through a connector, aka SPR RELS7LARKR.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2009-5059
Published: 2011-03-22
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.10 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by checking out a document that is accessed through a connector, aka SPR MMOI7PSR8J.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2009-5060
Published: 2011-03-22
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.11 services for Lotus Domino might allow remote authenticated users to cause a denial of service (daemon crash) by accessing an entry in a calendar, aka SPR MZHA7SEBJX.
CVSS Score: 3.5 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2009-5061
Published: 2011-03-22
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.14 services for Lotus Domino, when Domino Native Authentication is enabled, might allow remote authenticated users to cause a denial of service (daemon crash) by going offline, aka SPR MLZG7UPB9N.
CVSS Score: 2.1 (LOW)
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2009-5062
Published: 2011-03-22
Description: IBM Lotus Quickr 8.1 before 8.1.0.15 services for Lotus Domino on AIX allows remote authenticated users to cause a denial of service (daemon crash) by subscribing to an Atom feed, aka SPR JRIE7VKMP9.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg27013341; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2010-4228
Published: 2011-03-22
Description: Stack-based buffer overflow in NWFTPD.NLM before 5.10.02 in the FTP server in Novell NetWare allows remote authenticated users to execute arbitrary code or cause a denial of service (abend) via a long DELE command, a different vulnerability than CVE-2010-0625.4.
CVSS Score: 9.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43824; http://securityreason.com/securityalert/8149; http://www.novell.com/support/viewContent.do?externalId=3238588
CVE: CVE-2011-0331
Published: 2011-03-22
Description: Use-after-free vulnerability in the addOSPLext method in the Honeywell ScanServer ActiveX control 780.0.20.5 allows remote attackers to execute arbitrary code via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://osvdb.org/71249; http://secunia.com/advisories/43360; http://secunia.com/secunia_research/2011-22/
CVE: CVE-2011-0759
Published: 2011-03-22
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration page in the Recaptcha (aka WP-reCAPTCHA) plugin 2.9.8.2 for WordPress allow remote attackers to hijack the authentication of administrators for requests that disable the CAPTCHA requirement or insert cross-site scripting (XSS) sequences via the (1) recaptcha_opt_pubkey, (2) recaptcha_opt_privkey, (3) re_tabindex, (4) error_blank, (5) error_incorrect, (6) mailhide_pub, (7) mailhide_priv, (8) mh_replace_link, or (9) mh_replace_title parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-03/0206.html; http://secunia.com/advisories/43771; http://www.securityfocus.com/bid/46909
CVE: CVE-2011-1006
Published: 2011-03-22
Description: Heap-based buffer overflow in the parse_cgroup_spec function in tools/tools-common.c in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 allows local users to gain privileges via a crafted controller list on the command line of an application.  NOTE: it is not clear whether this issue crosses privilege boundaries.
CVSS Score: 7.2 (HIGH)
CWE: CWE-119
References: http://libcg.git.sourceforge.net/git/gitweb.cgi?p=libcg/libcg%3Ba=commit%3Bh=5ae8aea1ecd60c439121d3329d8eaabf13d292c1; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html
CVE: CVE-2011-1022
Published: 2011-03-22
Description: The cgre_receive_netlink_msg function in daemon/cgrulesengd.c in cgrulesengd in the Control Group Configuration Library (aka libcgroup or libcg) before 0.37.1 does not verify that netlink messages originated in the kernel, which allows local users to bypass intended resource restrictions via a crafted message.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=615987; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056683.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056734.html
CVE: CVE-2011-1414
Published: 2011-03-22
Description: Cross-site scripting (XSS) vulnerability in the tibbr web server, as used in TIBCO tibbr 1.0.0 through 1.5.0 and tibbr Service 1.0.0 through 1.5.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43765; http://securitytracker.com/id?1025220; http://www.osvdb.org/71178
CVE: CVE-2011-1505
Published: 2011-03-22
Description: Unspecified vulnerability in IBM Lotus Quickr 8.1 before 8.1.0.27 services for Lotus Domino has unknown impact and attack vectors, aka SPR ESEO8DQME2.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/43689; http://securitytracker.com/id?1025228; http://www-01.ibm.com/support/docview.wss?uid=swg27013341
CVE: CVE-2011-1506
Published: 2011-03-22
Description: The STARTTLS implementation in Kerio Connect 7.1.4 build 2985 and MailServer 6.x does not properly restrict I/O buffering, which allows man-in-the-middle attackers to insert commands into encrypted SMTP sessions by sending a cleartext command that is processed after TLS is in place, related to a "plaintext command injection" attack, a similar issue to CVE-2011-0411.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/43678; http://www.kb.cert.org/vuls/id/555316; http://www.kb.cert.org/vuls/id/MAPG-8D9M4P
CVE: CVE-2011-0172
Published: 2011-03-23
Description: AirPort in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to cause a denial of service (divide-by-zero error and reboot) via Wi-Fi frames on the local wireless network, a different vulnerability than CVE-2011-0162.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0173
Published: 2011-03-23
Description: Multiple format string vulnerabilities in AppleScript in Apple Mac OS X before 10.6.7 allow context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a (1) display dialog or (2) display alert command in a dialog in an AppleScript Studio application.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-134
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0174
Published: 2011-03-23
Description: Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code via a document that contains a crafted embedded OpenType font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0175
Published: 2011-03-23
Description: Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted embedded TrueType font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0176
Published: 2011-03-23
Description: Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted embedded Type 1 font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0177
Published: 2011-03-23
Description: Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code via a document that contains a crafted SFNT table in an embedded font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0178
Published: 2011-03-23
Description: The FSFindFolder API in CarbonCore in Apple Mac OS X before 10.6.7 provides a world-readable directory in response to a call with the kTemporaryFolderType flag, which allows local users to obtain potentially sensitive information by accessing this directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0179
Published: 2011-03-23
Description: CoreText in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a document that contains a crafted embedded font.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0180
Published: 2011-03-23
Description: Integer overflow in HFS in Apple Mac OS X before 10.6.7 allows local users to read arbitrary (1) HFS, (2) HFS+, or (3) HFS+J files via a crafted F_READBOOTSTRAP ioctl call.
CVSS Score: 2.1 (LOW)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0181
Published: 2011-03-23
Description: Integer overflow in ImageIO in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted XBM image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0182
Published: 2011-03-23
Description: The i386_set_ldt system call in the kernel in Apple Mac OS X before 10.6.7 does not properly handle call gates, which allows local users to gain privileges via vectors involving the creation of a call gate entry.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://securityreason.com/securityalert/8402; http://support.apple.com/kb/HT4581
CVE: CVE-2011-0183
Published: 2011-03-23
Description: Libinfo in Apple Mac OS X before 10.6.7 does not properly handle an unspecified integer field in an NFS RPC packet, which allows remote attackers to cause a denial of service (lockd, statd, mountd, or portmap outage) via a crafted packet, related to an "integer truncation issue."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0184
Published: 2011-03-23
Description: QuickLook in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via an Excel spreadsheet with a crafted formula that uses unspecified opcodes.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=898; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html