deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-5919
Published: 2012-11-19
Description: Multiple cross-site scripting (XSS) vulnerabilities in Havalite 1.0.4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) find or (2) replace fields to havalite/findReplace.php; (3) username parameter to havalite/hava_login.php, (4) the Edit Article module, or (5) hava_post.php in the postAuthor module; (6) postId parameter to hava_post.php; (7) userId parameter to hava_user.php; or (8) linkId parameter to hava_link.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81324; http://osvdb.org/81325; http://packetstormsecurity.org/files/112089/Havalite-CMS-1.0.4-Cross-Site-Scripting.html
CVE: CVE-2011-4612
Published: 2012-11-20
Description: icecast before 2.3.3 allows remote attackers to inject control characters such as newlines into the error loc (error.log) via a crafted URL.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090668.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090695.html; http://www.icecast.org/
CVE: CVE-2012-3354
Published: 2012-11-20
Description: doku.php in DokuWiki, as used in Fedora 16, 17, and 18, when certain PHP error levels are set, allows remote attackers to obtain sensitive information via the prefix parameter, which reveals the installation path in an error message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090755.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090899.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090938.html
CVE: CVE-2012-4366
Published: 2012-11-20
Description: Belkin wireless routers Surf N150 Model F7D1301v1, N900 Model F9K1104v1, N450 Model F9K1105V2, and N300 Model F7D2301v1 generate a predictable default WPA2-PSK passphrase based on eight digits of the WAN MAC address, which allows remote attackers to access the network by sniffing the beacon frames.
CVSS Score: 3.3 (LOW)
CWE: CWE-310
References: http://archives.neohapsis.com/archives/bugtraq/2012-11/0070.html; http://www.jakoblell.com/blog/2012/11/19/cve-2012-4366-insecure-default-wpa2-passphrase-in-multiple-belkin-wireless-routers/; http://www.securityfocus.com/bid/56591
CVE: CVE-2012-4510
Published: 2012-11-20
Description: cups-pk-helper before 0.2.3 does not properly wrap the (1) cupsGetFile and (2) cupsPutFile function calls, which allows user-assisted remote attackers to read or overwrite sensitive files using CUPS resources.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://www.debian.org/security/2012/dsa-2562; http://www.mandriva.com/security/advisories?name=MDVSA-2013:069; http://www.openwall.com/lists/oss-security/2012/10/12/2
CVE: CVE-2012-4523
Published: 2012-11-20
Description: radsecproxy before 1.6.1 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/51251; http://www.debian.org/security/2012/dsa-2573; http://www.openwall.com/lists/oss-security/2012/10/17/7
CVE: CVE-2012-4563
Published: 2012-11-20
Description: Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 Beta and release candidates before 2.4.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.openwall.com/lists/oss-security/2012/10/31/1; http://www.securityfocus.com/bid/56336; https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_4_0
CVE: CVE-2012-4566
Published: 2012-11-20
Description: The DTLS support in radsecproxy before 1.6.2 does not properly verify certificates when there are configuration blocks with CA settings that are unrelated to the block being used for verifying the certificate chain, which might allow remote attackers to bypass intended access restrictions and spoof clients, a different vulnerability than CVE-2012-4523.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://git.nordu.net/?p=radsecproxy.git%3Ba=commit%3Bh=3682c935facf5ccd7fa600644bbb76957155c680; http://secunia.com/advisories/51251; http://www.debian.org/security/2012/dsa-2573
CVE: CVE-2012-5519
Published: 2012-11-20
Description: CUPS 1.4.4, when running in certain Linux distributions such as Debian GNU/Linux, stores the web interface administrator key in /var/run/cups/certs/0 using certain permissions, which allows local users in the lpadmin group to read or write arbitrary files as root by leveraging the web interface.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=692791; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00003.html
CVE: CVE-2012-5529
Published: 2012-11-20
Description: TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query.
CVSS Score: 3.5 (LOW)
CWE: CWE-399
References: http://tracker.firebirdsql.org/browse/CORE-3884; http://www.debian.org/security/2013/dsa-2648; http://www.openwall.com/lists/oss-security/2012/11/14/6
CVE: CVE-2012-5920
Published: 2012-11-20
Description: Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 through 2.5 Final, as used in JBoss Operations Network (ON) 3.1.1 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.  NOTE: this issue exists because of an incomplete fix for CVE-2012-4563.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0187.html; http://www.openwall.com/lists/oss-security/2012/10/31/1; http://www.securityfocus.com/bid/57538
CVE: CVE-2012-2589
Published: 2012-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-4344.  Reason: This candidate is a duplicate of CVE-2012-4344.  Notes: All CVE users should reference CVE-2012-4344 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-2615
Published: 2012-11-20
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-5703.  Reason: This candidate is a duplicate of CVE-2012-5703.  Notes: All CVE users should reference CVE-2012-5703 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-5674
Published: 2012-11-20
Description: Unspecified vulnerability in Adobe ColdFusion 10 before Update 5, when Internet Information Services (IIS) is used, allows attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.1 (HIGH)
References: http://osvdb.org/87555; http://www.adobe.com/support/security/bulletins/apsb12-25.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/80139
CVE: CVE-2012-5703
Published: 2012-11-20
Description: The vSphere API in VMware ESXi 4.1 and ESX 4.1 allows remote attackers to cause a denial of service (host daemon crash) via an invalid value in a (1) RetrieveProp or (2) RetrievePropEx SOAP request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.coresecurity.com/content/vmware-esx-input-validation-error; http://www.securityfocus.com/bid/56571; http://www.securitytracker.com/id?1027782
CVE: CVE-2012-4201
Published: 2012-11-21
Description: The evalInSandbox implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 uses an incorrect context during the handling of JavaScript code that sets the location.href property, which allows remote attackers to conduct cross-site scripting (XSS) attacks or read arbitrary files by leveraging a sandboxed add-on.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4202
Published: 2012-11-21
Description: Heap-based buffer overflow in the image::RasterImage::DrawFrameTo function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via a crafted GIF image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4203
Published: 2012-11-21
Description: The New Tab page in Mozilla Firefox before 17.0 uses a privileged context for execution of JavaScript code by bookmarklets, which allows user-assisted remote attackers to run arbitrary programs by leveraging a javascript: URL in a bookmark.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4204
Published: 2012-11-21
Description: The str_unescape function in the JavaScript engine in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4205
Published: 2012-11-21
Description: Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 assign the system principal, rather than the sandbox principal, to XMLHttpRequest objects created in sandboxes, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks or obtain sensitive information by leveraging a sandboxed add-on.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4206
Published: 2012-11-21
Description: Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.
CVSS Score: 6.9 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://www.mozilla.org/security/announce/2012/mfsa2012-98.html; https://bugzilla.mozilla.org/show_bug.cgi?id=792106
CVE: CVE-2012-4207
Published: 2012-11-21
Description: The HZ-GB-2312 character-set implementation in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly handle a ~ (tilde) character in proximity to a chunk delimiter, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted document.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4208
Published: 2012-11-21
Description: The XrayWrapper implementation in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 does not consider the compartment during property filtering, which allows remote attackers to bypass intended chrome-only restrictions on reading DOM object properties via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4209
Published: 2012-11-21
Description: Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 do not prevent use of a "top" frame name-attribute value to access the location property, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via vectors involving a binary plugin.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4210
Published: 2012-11-21
Description: The Style Inspector in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 does not properly restrict the context of HTML markup and Cascading Style Sheets (CSS) token sequences, which allows user-assisted remote attackers to execute arbitrary JavaScript code with chrome privileges via a crafted stylesheet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4212
Published: 2012-11-21
Description: Use-after-free vulnerability in the XPCWrappedNative::Mark function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4213
Published: 2012-11-21
Description: Use-after-free vulnerability in the nsEditor::FindNextLeafNode function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4214
Published: 2012-11-21
Description: Use-after-free vulnerability in the nsTextEditorState::PrepareEditor function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-5840.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4215
Published: 2012-11-21
Description: Use-after-free vulnerability in the nsPlaintextEditor::FireClipboardEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4216
Published: 2012-11-21
Description: Use-after-free vulnerability in the gfxFont::GetFontEntry function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4217
Published: 2012-11-21
Description: Use-after-free vulnerability in the nsViewManager::ProcessPendingUpdates function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-4218
Published: 2012-11-21
Description: Use-after-free vulnerability in the BuildTextRunsScanner::BreakSink::SetBreaks function in Mozilla Firefox before 17.0, Thunderbird before 17.0, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-5471
Published: 2012-11-21
Description: The Dropbox Repository File Picker in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to access the Dropbox of a different user by leveraging an unattended workstation after a logout.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-29872; http://openwall.com/lists/oss-security/2012/11/19/1; http://www.securityfocus.com/bid/56505
CVE: CVE-2012-5472
Published: 2012-11-21
Description: lib/formslib.php in Moodle 2.2.x before 2.2.6 and 2.3.x before 2.3.3 allows remote authenticated users to bypass intended access restrictions via a modified value of a frozen form field.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-32785; http://openwall.com/lists/oss-security/2012/11/19/1; http://www.securityfocus.com/bid/56505
CVE: CVE-2012-5473
Published: 2012-11-21
Description: The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to read activity entries of a different group's users via an advanced search.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-34448; http://openwall.com/lists/oss-security/2012/11/19/1; http://www.securityfocus.com/bid/56505
CVE: CVE-2012-5479
Published: 2012-11-21
Description: The Portfolio plugin in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote authenticated users to upload and execute files via a modified Portfolio API callback.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-33791; http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-36346; http://openwall.com/lists/oss-security/2012/11/19/1
CVE: CVE-2012-5480
Published: 2012-11-21
Description: The Database activity module in Moodle 2.1.x before 2.1.9, 2.2.x before 2.2.6, and 2.3.x before 2.3.3 allows remote attackers to bypass intended restrictions on reading other participants' entries via an advanced search.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35558; http://openwall.com/lists/oss-security/2012/11/19/1; http://www.securityfocus.com/bid/56505
CVE: CVE-2012-5481
Published: 2012-11-21
Description: Moodle 2.3.x before 2.3.3 allows remote authenticated users to bypass the moodle/role:manage capability requirement and read all capability data by visiting the Check Permissions page.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-35381; http://openwall.com/lists/oss-security/2012/11/19/1; http://www.securityfocus.com/bid/56505
CVE: CVE-2012-5829
Published: 2012-11-21
Description: Heap-based buffer overflow in the nsWindow::OnExposeEvent function in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00007.html
CVE: CVE-2012-5830
Published: 2012-11-21
Description: Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 on Mac OS X allows remote attackers to execute arbitrary code via an HTML document.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-5833
Published: 2012-11-21
Description: The texImage2D implementation in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 does not properly interact with Mesa drivers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via function calls involving certain values of the level parameter.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html
CVE: CVE-2012-5835
Published: 2012-11-21
Description: Integer overflow in the WebGL subsystem in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before 2.14 allows remote attackers to execute arbitrary code or cause a denial of service (invalid write operation) via crafted data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-190
References: http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html; http://lists.opensuse.org/opensuse-security-announce/2013-01/msg00022.html; http://lists.opensuse.org/opensuse-updates/2012-11/msg00090.html