deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-1970
Published: 2009-07-14
Description: Unspecified vulnerability in the Listener component in Oracle Database 9.2.0.8, 9.2.0.8DV, 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote attackers to affect availability via unknown vectors, a different vulnerability than CVE-2009-0991.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/55891; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1973
Published: 2009-07-14
Description: Unspecified vulnerability in the Virtual Private Database component in Oracle Database 10.1.0.5, 10.2.0.4, and 11.1.0.7 allows remote authenticated users to affect confidentiality and integrity, related to VPD policies.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55890; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1974
Published: 2009-07-14
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to the Servlet Container Package.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/55906; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1975
Published: 2009-07-14
Description: Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality, integrity, and availability, related to the WLS Console Package.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html; http://www.securityfocus.com/bid/35673
CVE: CVE-2009-1976
Published: 2009-07-14
Description: Unspecified vulnerability in the HTTP Server component in Oracle Application Server 10.1.2.3 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/55896; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1977
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows attackers to bypass authentication via unknown vectors involving the username parameter and login.php.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/55903; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1978
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.
CVSS Score: 9.0 (HIGH)
References: http://osvdb.org/55904; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1980
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 6.0 (MEDIUM)
References: http://osvdb.org/55898; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1981
Published: 2009-07-14
Description: Unspecified vulnerability in the Highly Interactive Client component in Siebel Product Suite 7.5.3, 7.7.2, 7.8.2, 8.0.0.5, and 8.1.0 allows local users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 3.0 (LOW)
References: http://osvdb.org/55908; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1982
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2 and 12.0.6 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/55900; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1983
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle iStore component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://osvdb.org/55901; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1984
Published: 2009-07-14
Description: Unspecified vulnerability in the Application Install component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to the Patch Administrator.
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/55899; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1986
Published: 2009-07-14
Description: Unspecified vulnerability in the Oracle Applications Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 2.6 (LOW)
References: http://osvdb.org/55902; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1987
Published: 2009-07-14
Description: Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools - Enterprise Portal component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.49.21 allows remote attackers to affect integrity via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://osvdb.org/55909; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1988
Published: 2009-07-14
Description: Unspecified vulnerability in the PeopleSoft Enterprise HRMS eProfile Manager component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 19, and 9.0 Bundle 9 allows remote authenticated users to affect confidentiality via unknown vectors.
CVSS Score: 4.0 (MEDIUM)
References: http://osvdb.org/55910; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-1989
Published: 2009-07-14
Description: Unspecified vulnerability in the PeopleSoft Enterprise FMS component in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.8 SP1, 8.9 Bundle 33, and 9.0 Bundle 24 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVSS Score: 5.5 (MEDIUM)
References: http://osvdb.org/55911; http://secunia.com/advisories/35776; http://www.oracle.com/technetwork/topics/security/cpujul2009-091332.html
CVE: CVE-2009-0231
Published: 2009-07-15
Description: The Embedded OpenType (EOT) Font Engine (T2EMBED.DLL) in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table in a data record that triggers an integer truncation and a heap-based buffer overflow, aka "Embedded OpenType Font Heap Overflow Vulnerability."
CVSS Score: 8.8 (HIGH)
CWE: CWE-681
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=811; http://osvdb.org/55842; http://www.securitytracker.com/id?1022543
CVE: CVE-2009-0232
Published: 2009-07-15
Description: Integer overflow in the Embedded OpenType (EOT) Font Engine in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted name table, aka "Embedded OpenType Font Integer Overflow Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://www.securitytracker.com/id?1022543; http://www.us-cert.gov/cas/techalerts/TA09-195A.html; http://www.vupen.com/english/advisories/2009/1887
CVE: CVE-2009-0566
Published: 2009-07-15
Description: Microsoft Office Publisher 2007 SP1 does not properly calculate object handler data for Publisher files, which allows remote attackers to execute arbitrary code via a crafted file in a legacy format that triggers memory corruption, aka "Pointer Dereference Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55838; http://www.securityfocus.com/bid/35599; http://www.securitytracker.com/id?1022546
CVE: CVE-2009-1135
Published: 2009-07-15
Description: Microsoft Internet Security and Acceleration (ISA) Server 2006 Gold and SP1, when Radius OTP is enabled, uses the HTTP-Basic authentication method, which allows remote attackers to gain the privileges of an arbitrary account, and access published web pages, via vectors involving attempted access to a network resource behind the ISA Server, aka "Radius OTP Bypass Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35784; http://www.securitytracker.com/id?1022547; http://www.us-cert.gov/cas/techalerts/TA09-195A.html
CVE: CVE-2009-1136
Published: 2009-07-15
Description: The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx; http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx; http://isc.sans.org/diary.html?storyid=6778
CVE: CVE-2009-1538
Published: 2009-07-15
Description: The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 performs updates to pointers without properly validating unspecified data values, which allows remote attackers to execute arbitrary code via a crafted QuickTime media file, aka "DirectX Pointer Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://osvdb.org/55844; http://www.securityfocus.com/bid/35600; http://www.us-cert.gov/cas/techalerts/TA09-195A.html
CVE: CVE-2009-1539
Published: 2009-07-15
Description: The QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 does not properly validate unspecified size fields in QuickTime media files, which allows remote attackers to execute arbitrary code via a crafted file, aka "DirectX Size Validation Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://osvdb.org/55845; http://www.us-cert.gov/cas/techalerts/TA09-195A.html; http://www.vupen.com/english/advisories/2009/1886
CVE: CVE-2009-1542
Published: 2009-07-15
Description: The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka "Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability."
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/35808; http://www.securitytracker.com/id?1022544; http://www.us-cert.gov/cas/techalerts/TA09-195A.html
CVE: CVE-2009-2477
Published: 2009-07-15
Description: js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/; http://isc.sans.org/diary.html?storyid=6796; http://secunia.com/advisories/35798
CVE: CVE-2009-1895
Published: 2009-07-16
Description: The personality subsystem in the Linux kernel before 2.6.31-rc3 has a PER_CLEAR_ON_SETID setting that does not clear the ADDR_COMPAT_LAYOUT and MMAP_PAGE_ZERO flags when executing a setuid or setgid program, which makes it easier for local users to leverage the details of memory usage to (1) conduct NULL pointer dereference attacks, (2) bypass the mmap_min_addr protection mechanism, or (3) defeat address space layout randomization (ASLR).
CVSS Score: 7.2 (HIGH)
CWE: CWE-16
References: http://blog.cr0.org/2009/06/bypassing-linux-null-pointer.html; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9fabcb58a6d26d6efde842d1703ac7cfa9427b6; http://patchwork.kernel.org/patch/32598/
CVE: CVE-2009-2047
Published: 2009-07-16
Description: Directory traversal vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to read, modify, or delete arbitrary files via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-22
References: http://osvdb.org/55936; http://secunia.com/advisories/35861; http://www.cisco.com/en/US/products/products_security_advisory09186a0080ae04b2.shtml
CVE: CVE-2009-2048
Published: 2009-07-16
Description: Cross-site scripting (XSS) vulnerability in the Administration interface in Cisco Customer Response Solutions (CRS) before 7.0(1) SR2 in Cisco Unified Contact Center Express (aka CCX) server allows remote authenticated users to inject arbitrary web script or HTML into the CCX database via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/55937; http://secunia.com/advisories/35861; http://www.cisco.com/en/US/products/products_security_advisory09186a0080ae04b2.shtml
CVE: CVE-2009-2478
Published: 2009-07-16
Description: Mozilla Firefox 3.5 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors, related to a "flash bug."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: https://bugzilla.mozilla.org/show_bug.cgi?id=502648; https://bugzilla.mozilla.org/show_bug.cgi?id=503286; https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html
CVE: CVE-2009-2479
Published: 2009-07-16
Description: Mozilla Firefox 3.0.x, 3.5, and 3.5.1 on Windows allows remote attackers to cause a denial of service (uncaught exception and application crash) via a long Unicode string argument to the write method. NOTE: this was originally reported as a stack-based buffer overflow. NOTE: on Linux and Mac OS X, a crash resulting from this long string reportedly occurs in an operating-system library, not in Firefox.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://blog.mozilla.com/security/2009/07/19/milw0rm-9158-stack-overflow-crash-not-exploitable-cve-2009-2479/; http://osvdb.org/55931; http://websecurity.com.ua/3338/
CVE: CVE-2009-2480
Published: 2009-07-16
Description: Cross-site scripting (XSS) vulnerability in mt-wizard.cgi in Six Apart Movable Type 4.24, and 4.25 when global templates are not initialized, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN97248625/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000020.html; http://secunia.com/advisories/35534
CVE: CVE-2009-2481
Published: 2009-07-16
Description: mt-wizard.cgi in Six Apart Movable Type before 4.261, when global templates are not initialized, allows remote attackers to bypass access restrictions and (1) send e-mail to arbitrary addresses or (2) obtain sensitive information via unspecified vectors.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-287
References: http://jvn.jp/en/jp/JVN08369659/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000043.html; http://secunia.com/advisories/35534
CVE: CVE-2009-2482
Published: 2009-07-16
Description: The pam_unix module in OpenPAM in NetBSD 4.0 before 4.0.2 and 5.0 before 5.0.1 allows local users to change the current root password if it is already known, even when they are not in the wheel group.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-004.txt.asc; http://osvdb.org/55284; http://secunia.com/advisories/35553
CVE: CVE-2009-2483
Published: 2009-07-16
Description: libprop/prop_object.c in proplib in NetBSD 4.0 and 4.0.1 allows local users to cause a denial of service (NULL pointer dereference and kernel panic) via a malformed externalized plist (XML form) containing an undefined element.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-189
References: ftp://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2009-003.txt.asc; http://osvdb.org/55285; http://secunia.com/advisories/35556
CVE: CVE-2009-2484
Published: 2009-07-16
Description: Stack-based buffer overflow in the Win32AddConnection function in modules/access/smb.c in VideoLAN VLC media player 0.9.9, when running on Microsoft Windows, allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long smb URI in a playlist file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://git.videolan.org/?p=vlc.git%3Ba=commit%3Bh=e60a9038b13b5eb805a76755efc5c6d5e080180f; http://secunia.com/advisories/35558; http://www.exploit-db.com/exploits/9029
CVE: CVE-2009-2485
Published: 2009-07-16
Description: Stack-based buffer overflow in HT-MP3Player 1.0 allows remote attackers to execute arbitrary code via a long string in a .ht3 file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://www.exploit-db.com/exploits/9034; http://www.exploit-db.com/exploits/9034
CVE: CVE-2009-2486
Published: 2009-07-16
Description: Unspecified vulnerability in the SCTP implementation in Sun Solaris 10, and OpenSolaris before snv_120, allows remote attackers to cause a denial of service (panic) via unspecified packets.
CVSS Score: 7.8 (HIGH)
References: http://osvdb.org/55875; http://secunia.com/advisories/35873; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141414-01-1
CVE: CVE-2009-2487
Published: 2009-07-16
Description: Use-after-free vulnerability in the frpr_icmp function in the ipfilter (aka IP Filter) subsystem in Sun Solaris 10, and OpenSolaris snv_45 through snv_110, allows remote attackers to cause a denial of service (panic) via unspecified vectors.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://osvdb.org/55874; http://secunia.com/advisories/35881; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141020-01-1
CVE: CVE-2009-2488
Published: 2009-07-16
Description: Unspecified vulnerability in the NFSv4 module in the kernel in Sun Solaris 10, and OpenSolaris snv_102 through snv_119, allows local users to cause a denial of service (client panic) via vectors involving "file operations."
CVSS Score: 4.9 (MEDIUM)
References: http://osvdb.org/55876; http://secunia.com/advisories/35874; http://sunsolve.sun.com/search/document.do?assetkey=1-21-141733-03-1
CVE: CVE-2009-2489
Published: 2009-07-16
Description: Unspecified vulnerability in the utdmsession program in Sun Ray Server Software (SRSS) 4.0 allows local users to access the sessions of arbitrary users via unknown vectors.
CVSS Score: 2.1 (LOW)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-06-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-252226-1; http://www.vupen.com/english/advisories/2009/1915
CVE: CVE-2009-2490
Published: 2009-07-16
Description: Unspecified vulnerability in the utaudiod daemon in Sun Ray Server Software (SRSS) 4.0, when Solaris Trusted Extensions is enabled, allows local users to cause a denial of service (audio outage) or possibly gain privileges via unknown vectors related to "resource leaks."
CVSS Score: 1.9 (LOW)
References: http://osvdb.org/55979; http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-06-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-253889-1
CVE: CVE-2009-2491
Published: 2009-07-16
Description: The utaudiod daemon in Sun Ray Server Software (SRSS) 4.0, when Solaris Trusted Extensions is enabled, allows local users to access the sessions of arbitrary users via unknown vectors related to "resource leaks."
CVSS Score: 4.4 (MEDIUM)
References: http://osvdb.org/55978; http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-06-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-253889-1
CVE: CVE-2009-1892
Published: 2009-07-17
Description: dhcpd in ISC DHCP 3.0.4 and 3.1.1, when the dhcp-client-identifier and hardware ethernet configuration settings are both used, allows remote attackers to cause a denial of service (daemon crash) via unspecified requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/35830; http://secunia.com/advisories/35851; http://secunia.com/advisories/36457
CVE: CVE-2009-1893
Published: 2009-07-17
Description: The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://secunia.com/advisories/35831; http://securitytracker.com/id?1022554; http://www.redhat.com/support/errata/RHSA-2009-1154.html
CVE: CVE-2009-1894
Published: 2009-07-17
Description: Race condition in PulseAudio 0.9.9, 0.9.10, and 0.9.14 allows local users to gain privileges via vectors involving creation of a hard link, related to the application setting LD_BIND_NOW to 1, and then calling execv on the target of the /proc/self/exe symlink.
CVSS Score: 7.2 (HIGH)
CWE: CWE-362
References: http://blog.cr0.org/2009/07/old-school-local-root-vulnerability-in.html; http://secunia.com/advisories/35868; http://secunia.com/advisories/35886
CVE: CVE-2009-2348
Published: 2009-07-17
Description: Android 1.5 CRBxx allows local users to bypass the (1) Manifest.permission.CAMERA (aka android.permission.CAMERA) and (2) Manifest.permission.AUDIO_RECORD (aka android.permission.RECORD_AUDIO) configuration settings by installing and executing an application that does not make a permission request before using the camera or microphone.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-94
References: http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=4d8adefd35efdea849611b8b02d61f9517e47760; http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=7b7225c8fdbead25235c74811b30ff4ee690dc58; http://android.git.kernel.org/?p=platform/packages/apps/Camera.git%3Ba=commit%3Bh=e655d54160e5a56d4909f2459eeae9012e9f187f