deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-3220
Published: 2014-05-05
Description: F5 BIG-IQ Cloud and Security 4.0.0 through 4.1.0 allows remote authenticated users to change the password of arbitrary users via the name parameter in a request to the user's page in mgmt/shared/authz/users/.
CVSS Score: 9.0 (HIGH)
CWE: CWE-255
References: http://seclists.org/fulldisclosure/2014/May/10; http://seclists.org/fulldisclosure/2014/May/11; http://seclists.org/fulldisclosure/2014/May/16
CVE: CVE-2014-0185
Published: 2014-05-06
Description: sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
CVSS Score: 7.2 (HIGH)
CWE: CWE-269
References: http://lists.opensuse.org/opensuse-updates/2015-10/msg00012.html; http://secunia.com/advisories/59061; http://secunia.com/advisories/59329
CVE: CVE-2014-0198
Published: 2014-05-06
Description: The do_ssl3_write function in s3_pkt.c in OpenSSL 1.x through 1.0.1g, when SSL_MODE_RELEASE_BUFFERS is enabled, does not properly manage a buffer pointer during certain recursive calls, which allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via vectors that trigger an alert condition.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-476
References: http://advisories.mageia.org/MGASA-2014-0204.html; http://aix.software.ibm.com/aix/efixes/security/openssl_advisory9.asc; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10629
CVE: CVE-2014-1736
Published: 2014-05-06
Description: Integer overflow in api.cc in Google V8, as used in Google Chrome before 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a large length value.
CVSS Score: 7.5 (HIGH)
CWE: CWE-190
References: http://googlechromereleases.blogspot.com/2014/04/stable-channel-update_24.html; http://secunia.com/advisories/58301; http://www.debian.org/security/2014/dsa-2920
CVE: CVE-2014-2347
Published: 2014-05-06
Description: Amtelco miSecureMessages (aka MSM) 6.2 does not properly manage sessions, which allows remote authenticated users to obtain sensitive information via a modified message request.
CVSS Score: 7.0 (HIGH)
CWE: CWE-200, CWE-264
References: https://service.amtelco.com/INFINITY/MSM/MSM6.2SecurityBriefing.pdf; https://www.cisa.gov/news-events/ics-advisories/icsa-14-121-01; http://ics-cert.us-cert.gov/advisories/ICSA-14-121-01
CVE: CVE-2013-7353
Published: 2014-05-06
Description: Integer overflow in the png_set_unknown_chunks function in libpng/pngset.c in libpng before 1.5.14beta08 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a crafted image, which triggers a heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189, CWE-122, CWE-190
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00015.html; http://seclists.org/oss-sec/2014/q2/83; http://sourceforge.net/p/libpng/bugs/199/
CVE: CVE-2013-7354
Published: 2014-05-06
Description: Multiple integer overflows in libpng before 1.5.14rc03 allow remote attackers to cause a denial of service (crash) via a crafted image to the (1) png_set_sPLT or (2) png_set_text_2 function, which triggers a heap-based buffer overflow.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-189, CWE-122, CWE-190
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00015.html; http://seclists.org/oss-sec/2014/q2/83; http://sourceforge.net/p/libpng/bugs/199/
CVE: CVE-2014-0193
Published: 2014-05-06
Description: WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://netty.io/news/2014/04/30/release-day.html; http://rhn.redhat.com/errata/RHSA-2014-1019.html; http://rhn.redhat.com/errata/RHSA-2014-1020.html
CVE: CVE-2014-2558
Published: 2014-05-06
Description: The File Gallery plugin before 1.7.9.2 for WordPress does not properly escape strings, which allows remote administrators to execute arbitrary PHP code via a \' (backslash quote) in the setting fields to /wp-admin/options-media.php, related to the create_function function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-94
References: http://seclists.org/fulldisclosure/2014/Apr/305; http://wordpress.org/plugins/file-gallery/changelog/; http://www.securityfocus.com/bid/67120
CVE: CVE-2014-3202
Published: 2014-05-06
Description: Unity before 7.2.1 does not properly handle entry activation, which allows physically proximate attackers to bypass the lock screen by holding the ENTER key, which triggers the process to crash.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://www.openwall.com/lists/oss-security/2014/04/26/1; http://www.openwall.com/lists/oss-security/2014/04/26/2; http://www.openwall.com/lists/oss-security/2014/04/29/2
CVE: CVE-2014-3203
Published: 2014-05-06
Description: Unity before 7.2.1, as used in Ubuntu 14.04, does not properly restrict access to the Dash when the lock screen is active, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by pressing the SUPER key before the screen auto-locks.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://ubuntu.com/usn/usn-2184-1; http://www.openwall.com/lists/oss-security/2014/04/29/2; http://www.openwall.com/lists/oss-security/2014/05/03/1
CVE: CVE-2014-3204
Published: 2014-05-06
Description: Unity before 7.2.1, as used in Ubuntu 14.04, does not properly handle keyboard shortcuts, which allows physically proximate attackers to bypass the lock screen and execute arbitrary commands, as demonstrated by right-clicking on the indicator bar and then pressing the ALT and F2 keys.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://ubuntu.com/usn/usn-2184-1; http://www.openwall.com/lists/oss-security/2014/04/29/2; http://www.openwall.com/lists/oss-security/2014/05/03/1
CVE: CVE-2013-6726
Published: 2014-05-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21671968; https://exchange.xforce.ibmcloud.com/vulnerabilities/89281; http://www-01.ibm.com/support/docview.wss?uid=swg21671968
CVE: CVE-2013-7336
Published: 2014-05-07
Description: The qemuMigrationWaitForSpice function in qemu/qemu_migration.c in libvirt before 1.1.3 does not properly enter a monitor when performing seamless SPICE migration, which allows local users to cause a denial of service (NULL pointer dereference and libvirtd crash) by causing domblkstat to be called at the same time as the qemuMonitorGetSpiceMigrationStatus function.
CVSS Score: 1.9 (LOW)
References: http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=484cc321; http://libvirt.org/news.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00004.html
CVE: CVE-2014-0130
Published: 2014-05-07
Description: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf; http://rhn.redhat.com/errata/RHSA-2014-1863.html; http://www.securityfocus.com/bid/67244
CVE: CVE-2014-0196
Published: 2014-05-07
Description: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-362, CWE-362
References: http://bugzilla.novell.com/show_bug.cgi?id=875690; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00; http://linux.oracle.com/errata/ELSA-2014-0771.html
CVE: CVE-2014-0684
Published: 2014-05-07
Description: Cisco NX-OS 6.2(2) on Nexus 7000 switches allows local users to cause a denial of service via crafted sed input, aka Bug ID CSCui56136.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0684; http://tools.cisco.com/security/center/viewAlert.x?alertId=34131; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0684
CVE: CVE-2014-0685
Published: 2014-05-07
Description: Cisco Nexus 1000V InterCloud 5.2(1)IC1(1.2) and earlier for VMware allows remote attackers to bypass ACL deny statements via crafted (1) IGMPv2 or (2) IGMPv3 packets, aka Bug ID CSCug61691.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0685; http://tools.cisco.com/security/center/viewAlert.x?alertId=34130; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0685
CVE: CVE-2014-0911
Published: 2014-05-07
Description: inetd in IBM WebSphere MQ 7.1.x before 7.1.0.5 and 7.5.x before 7.5.0.4 allows remote attackers to cause a denial of service (disk or CPU consumption) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV55886; http://www-01.ibm.com/support/docview.wss?uid=swg21670374; https://exchange.xforce.ibmcloud.com/vulnerabilities/91876
CVE: CVE-2014-2181
Published: 2014-05-07
Description: Cisco Adaptive Security Appliance (ASA) Software allows remote authenticated users to read files by sending a crafted URL to the HTTP server, as demonstrated by reading the running configuration, aka Bug ID CSCun78551.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2181; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2181
CVE: CVE-2014-2190
Published: 2014-05-07
Description: Cross-site request forgery (CSRF) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to hijack the authentication of arbitrary users for requests that make BAC-TW changes, aka Bug IDs CSCuo23804 and CSCuo26389.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2190; http://www.securitytracker.com/id/1030199; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2190
CVE: CVE-2014-2191
Published: 2014-05-07
Description: Cross-site scripting (XSS) vulnerability in the web framework in Cisco Broadcast Access Center for Telco and Wireless (aka BAC-TW) allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCun91113.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2191; http://www.securitytracker.com/id/1030198; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-2191
CVE: CVE-2014-2891
Published: 2014-05-07
Description: strongSwan before 5.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon crash) via a crafted ID_DER_ASN1_DN ID payload.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-updates/2014-05/msg00064.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00066.html; http://secunia.com/advisories/59864
CVE: CVE-2014-2913
Published: 2014-05-07
Description: Incomplete blacklist vulnerability in nrpe.c in Nagios Remote Plugin Executor (NRPE) 2.15 and earlier allows remote attackers to execute arbitrary commands via a newline character in the -a option to libexec/check_nrpe.  NOTE: this issue is disputed by multiple parties. It has been reported that the vendor allows newlines as "expected behavior." Also, this issue can only occur when the administrator enables the "dont_blame_nrpe" option in nrpe.conf despite the "HIGH security risk" warning within the comments
CVSS Score: 7.5 (HIGH)
References: http://lists.fedoraproject.org/pipermail/package-announce/2015-September/166528.html; http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00011.html; http://lists.opensuse.org/opensuse-updates/2014-05/msg00005.html
CVE: CVE-2014-3124
Published: 2014-05-07
Description: The HVMOP_set_mem_type control in Xen 4.1 through 4.4.x allows local guest HVM administrators to cause a denial of service (hypervisor crash) or possibly execute arbitrary code by leveraging a separate qemu-dm vulnerability to trigger invalid page table translations for unspecified memory page types.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133148.html; http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133191.html; http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00003.html
CVE: CVE-2013-5016
Published: 2014-05-08
Description: Symantec Critical System Protection (SCSP) before 5.2.9, when installed on an unpatched Windows Server 2003 R2 platform, allows remote attackers to bypass policy settings via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/67161; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20140502_00; http://www.securityfocus.com/bid/67161
CVE: CVE-2014-0116
Published: 2014-05-08
Description: CookieInterceptor in Apache Struts 2.x before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and modify session state via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0113.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/59816; http://struts.apache.org/release/2.3.x/docs/s2-022.html; http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-350733.htm
CVE: CVE-2014-0362
Published: 2014-05-08
Description: Cross-site scripting (XSS) vulnerability on Google Search Appliance (GSA) devices before 7.0.14.G.216 and 7.2 before 7.2.0.G.114, when dynamic navigation is configured, allows remote attackers to inject arbitrary web script or HTML via input included in a SCRIPT element.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.kb.cert.org/vuls/id/673313; http://www.securityfocus.com/bid/67176; http://www.kb.cert.org/vuls/id/673313
CVE: CVE-2014-0595
Published: 2014-05-08
Description: /opt/novell/ncl/bin/nwrights in Novell Client for Linux in Novell Open Enterprise Server (OES) 11 Linux SP2 does not properly manage a certain array, which allows local users to obtain the S permission in opportunistic circumstances by leveraging the granting of the F permission by an administrator.
CVSS Score: 2.6 (LOW)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00030.html; http://www.novell.com/support/kb/doc.php?id=7014932; http://www.securityfocus.com/bid/67144
CVE: CVE-2014-0930
Published: 2014-05-08
Description: The ptrace system call in IBM AIX 5.3, 6.1, and 7.1, and VIOS 2.2.x, allows local users to cause a denial of service (system crash) or obtain sensitive information from kernel memory via a crafted PT_LDINFO operation.
CVSS Score: 4.7 (MEDIUM)
References: http://aix.software.ibm.com/aix/efixes/security/ptrace_advisory.asc; http://archives.neohapsis.com/archives/bugtraq/2014-05/0031.html; http://www.ibm.com/support/docview.wss?uid=isg1IV58766
CVE: CVE-2014-0963
Published: 2014-05-08
Description: The Reverse Proxy feature in IBM Global Security Kit (aka GSKit) in IBM Security Access Manager (ISAM) for Web 7.0 before 7.0.0-ISS-SAM-IF0006 and 8.0 before 8.0.0.3-ISS-WGA-IF0002 allows remote attackers to cause a denial of service (infinite loop) via crafted SSL messages.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/58845; http://secunia.com/advisories/59245; http://secunia.com/advisories/59249
CVE: CVE-2014-2132
Published: 2014-05-08
Description: Cisco WebEx Recording Format (WRF) player and Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allow remote attackers to cause a denial of service (application crash) via a crafted (1) .wrf or (2) .arf file that triggers a buffer over-read, aka Bug ID CSCuh52768.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex
CVE: CVE-2014-2133
Published: 2014-05-08
Description: Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file that triggers improper LZW decompression, aka Bug ID CSCuj87565.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex
CVE: CVE-2014-2134
Published: 2014-05-08
Description: Heap-based buffer overflow in Cisco WebEx Recording Format (WRF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted audio channel in a .wrf file, aka Bug ID CSCuc39458.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex
CVE: CVE-2014-2135
Published: 2014-05-08
Description: Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCul87216 and CSCuj07603.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex
CVE: CVE-2014-2136
Published: 2014-05-08
Description: Buffer overflow in Cisco Advanced Recording Format (ARF) player T27 LD before SP32 EP16, T28 before T28.12, and T29 before T29.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .arf file, aka Bug IDs CSCui72223, CSCul01163, and CSCul01166.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140507-webex
CVE: CVE-2014-2602
Published: 2014-05-08
Description: Unspecified vulnerability in HP OneView 1.0 and 1.01 allows remote authenticated users to gain privileges via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
References: https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04273152; https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04273152
CVE: CVE-2014-2933
Published: 2014-05-08
Description: Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://www.kb.cert.org/vuls/id/693092; http://www.kb.cert.org/vuls/id/693092
CVE: CVE-2014-2934
Published: 2014-05-08
Description: Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2) costview2/printers.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.kb.cert.org/vuls/id/693092; http://www.kb.cert.org/vuls/id/693092
CVE: CVE-2014-2935
Published: 2014-05-08
Description: costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-78
References: http://www.kb.cert.org/vuls/id/693092; http://www.securityfocus.com/bid/67252; http://www.kb.cert.org/vuls/id/693092
CVE: CVE-2014-2936
Published: 2014-05-08
Description: The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to dirmng/index.php, or an unspecified parameter to (2) PPD/index.php, (3) dirmng/docmd.php, or (4) dirmng/param.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://www.kb.cert.org/vuls/id/693092; http://www.securityfocus.com/bid/67254; http://www.kb.cert.org/vuls/id/693092
CVE: CVE-2014-3215
Published: 2014-05-08
Description: seunshare in policycoreutils 2.2.5 is owned by root with 4755 permissions, and executes programs in a way that changes the relationship between the setuid system call and the getresuid saved set-user-ID value, which makes it easier for local users to gain privileges by leveraging a program that mistakenly expected that it could permanently drop privileges.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://advisories.mageia.org/MGASA-2014-0251.html; http://lists.opensuse.org/opensuse-updates/2014-06/msg00008.html; http://openwall.com/lists/oss-security/2014/04/29/7
CVE: CVE-2014-3421
Published: 2014-05-08
Description: lisp/gnus/gnus-fun.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on the /tmp/gnus.face.ppm temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0250.html; http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00055.html
CVE: CVE-2014-3422
Published: 2014-05-08
Description: lisp/emacs-lisp/find-gc.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a temporary file under /tmp/esrc/.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0250.html; http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00056.html
CVE: CVE-2014-3423
Published: 2014-05-08
Description: lisp/net/browse-url.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/Mosaic.##### temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0250.html; http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00057.html
CVE: CVE-2014-3424
Published: 2014-05-08
Description: lisp/net/tramp-sh.el in GNU Emacs 24.3 and earlier allows local users to overwrite arbitrary files via a symlink attack on a /tmp/tramp.##### temporary file.
CVSS Score: 3.3 (LOW)
CWE: CWE-59
References: http://advisories.mageia.org/MGASA-2014-0250.html; http://debbugs.gnu.org/cgi/bugreport.cgi?bug=17428#8; http://lists.gnu.org/archive/html/emacs-diffs/2014-05/msg00060.html