deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-3322
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a display name.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV23838; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/77918
CVE: CVE-2012-3327
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to a login action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV22698; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/78039
CVE: CVE-2012-3328
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.1, Maximo Asset Management Essentials 7.1, Tivoli Asset Management for IT 7.1 and 7.2, Tivoli Service Request Manager 7.1 and 7.2, and Change and Configuration Management Database (CCMDB) 7.1 and 7.2 allows remote attackers to inject arbitrary web script or HTML via vectors related to a hidden frame footer.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV20823; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/78040
CVE: CVE-2012-5760
Published: 2013-02-20
Description: SQL injection vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80137; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5761
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80138; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5762
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject arbitrary web script or HTML via vectors involving the MHTML protocol.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80204; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5763
Published: 2013-02-20
Description: Cross-site request forgery (CSRF) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80205; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5940
Published: 2013-02-20
Description: The WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza, when SSL is not enabled, allows remote attackers to discover credentials by sniffing the network during the authentication process.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80535; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5941
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in the WebAdmin application 6.0.5, 6.0.8, and 7.0 before P2 in IBM Netezza allows remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624568; https://exchange.xforce.ibmcloud.com/vulnerabilities/80536; http://www-01.ibm.com/support/docview.wss?uid=swg21624568
CVE: CVE-2012-5952
Published: 2013-02-20
Description: IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2 does not validate Basic Authentication credentials before proceeding to WS-Addressing and WS-Security operations, which allows remote attackers to trigger transmission of unauthenticated messages via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC89803; http://www-01.ibm.com/support/docview.wss?uid=swg21623316; https://exchange.xforce.ibmcloud.com/vulnerabilities/80666
CVE: CVE-2012-5953
Published: 2013-02-20
Description: IBM WebSphere Message Broker 6.1 before 6.1.0.12, 7.0 before 7.0.0.6, and 8.0 before 8.0.0.2, when the Parse Query Strings option is enabled on an HTTPInput node, allows remote attackers to cause a denial of service (infinite loop) via a crafted query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PM75015; http://www-01.ibm.com/support/docview.wss?uid=swg21623316; https://exchange.xforce.ibmcloud.com/vulnerabilities/80667
CVE: CVE-2012-6355
Published: 2013-02-20
Description: IBM Maximo Asset Management 6.2 through 7.5, Maximo Asset Management Essentials 6.2 through 7.5, Tivoli Asset Management for IT 6.2 through 7.2, Tivoli Service Request Manager 7.1 and 7.2, Maximo Service Desk 6.2, Change and Configuration Management Database (CCMDB) 7.1 and 7.2, and SmartCloud Control Desk 7.5 allow remote authenticated users to gain privileges via vectors related to a work order.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV30384; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/80747
CVE: CVE-2012-6356
Published: 2013-02-20
Description: IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to gain privileges via vectors related to an import operation.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV27329; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/80748
CVE: CVE-2012-6357
Published: 2013-02-20
Description: IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allow remote authenticated users to gain privileges and bypass intended restrictions on asset-lookup operations via unspecified vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV23511; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/80749
CVE: CVE-2013-0457
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in IBM Maximo Asset Management 7.5, Maximo Asset Management Essentials 7.5, and SmartCloud Control Desk 7.5 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to a uisessionid.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV20590; http://www-01.ibm.com/support/docview.wss?uid=swg21625624; https://exchange.xforce.ibmcloud.com/vulnerabilities/81011
CVE: CVE-2013-0466
Published: 2013-02-20
Description: Cross-site scripting (XSS) vulnerability in IBM WebSphere Message Broker 7.0 before 7.0.0.6 and 8.0 before 8.0.0.2, when wsdl support is enabled on a SOAPInput node, allows remote attackers to inject arbitrary web script or HTML via a wsdl request that is not properly handled during construction of an error message.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC89383; http://www-01.ibm.com/support/docview.wss?uid=swg21623316; https://exchange.xforce.ibmcloud.com/vulnerabilities/81062
CVE: CVE-2013-1484
Published: 2013-02-20
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.
CVSS Score: 10.0 (HIGH)
References: http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8139&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5818&w=2
CVE: CVE-2013-1485
Published: 2013-02-20
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier allows remote attackers to affect integrity via unknown vectors related to Libraries.
CVSS Score: 5.0 (MEDIUM)
References: http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/; http://marc.info/?l=bugtraq&m=[PII_REDACTED]8139&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5818&w=2
CVE: CVE-2013-1486
Published: 2013-02-20
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 13 and earlier, 6 Update 39 and earlier, and 5.0 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVSS Score: 10.0 (HIGH)
References: http://blog.fuseyism.com/index.php/2013/02/20/security-icedtea-2-1-6-2-2-6-2-3-7-for-openjdk-7-released/; http://lists.opensuse.org/opensuse-security-announce/2013-02/msg00020.html; http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00000.html
CVE: CVE-2013-1487
Published: 2013-02-20
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE 7 Update 13 and earlier and 6 Update 39 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]8139&w=2; http://marc.info/?l=bugtraq&m=[PII_REDACTED]5818&w=2; http://rhn.redhat.com/errata/RHSA-2013-1455.html
CVE: CVE-2013-0467
Published: 2013-02-21
Description: IBM Eclipse Help System (IEHS), as used in IBM Data Studio 3.1 and 3.1.1 and other products, allows remote authenticated users to read source code via a crafted URL.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://www-01.ibm.com/support/docview.wss?uid=swg21625573; https://exchange.xforce.ibmcloud.com/vulnerabilities/81102; http://www-01.ibm.com/support/docview.wss?uid=swg21625573
CVE: CVE-2013-0477
Published: 2013-02-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allow remote authenticated users to inject content, and conduct phishing attacks, via unspecified vectors.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624952; https://exchange.xforce.ibmcloud.com/vulnerabilities/81481; http://www-01.ibm.com/support/docview.wss?uid=swg21624952
CVE: CVE-2013-0478
Published: 2013-02-21
Description: Cross-site scripting (XSS) vulnerability in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 and 10.1 before FP1 and InfoSphere Master Data Management Server for Product Information Management 6.0, 9.0, and 9.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg21624952; https://exchange.xforce.ibmcloud.com/vulnerabilities/81482; http://www-01.ibm.com/support/docview.wss?uid=swg21624952
CVE: CVE-2013-0471
Published: 2013-02-21
Description: The traditional scheduler in the client in IBM Tivoli Storage Manager (TSM) before 6.2.5.0, 6.3 before 6.3.1.0, and 6.4 before 6.4.0.1, when Prompted mode is enabled, allows remote attackers to cause a denial of service (scheduling outage) via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC87331; http://www-01.ibm.com/support/docview.wss?uid=swg21624135; https://exchange.xforce.ibmcloud.com/vulnerabilities/81215
CVE: CVE-2013-0472
Published: 2013-02-21
Description: The Web GUI in the client in IBM Tivoli Storage Manager (TSM) 6.3 before 6.3.1.0 and 6.4 before 6.4.0.1 allows man-in-the-middle attackers to obtain unspecified client access, and consequently obtain unspecified server access, via unknown vectors.
CVSS Score: 5.1 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC87210; http://www-01.ibm.com/support/docview.wss?uid=swg21624118; https://exchange.xforce.ibmcloud.com/vulnerabilities/81216
CVE: CVE-2012-5536
Published: 2013-02-22
Description: A certain Red Hat build of the pam_ssh_agent_auth module on Red Hat Enterprise Linux (RHEL) 6 and Fedora Rawhide calls the glibc error function instead of the error function in the OpenSSH codebase, which allows local users to obtain sensitive information from process memory or possibly gain privileges via crafted use of an application that relies on this module, as demonstrated by su and sudo.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://pkgs.fedoraproject.org/cgit/openssh.git/commit/?id=4f4687ce8045418f678c323bb22c837f35d7b9fa; http://rhn.redhat.com/errata/RHSA-2013-0519.html; https://bugzilla.redhat.com/show_bug.cgi?id=834618
CVE: CVE-2013-0309
Published: 2013-02-22
Description: arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROT_NONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=027ef6c87853b0a9df[PII_REDACTED]8edb4950d476; http://rhn.redhat.com/errata/RHSA-2013-0496.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.6.2
CVE: CVE-2013-0310
Published: 2013-02-22
Description: The cipso_v4_validate function in net/ipv4/cipso_ipv4.c in the Linux kernel before 3.4.8 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an IPOPT_CIPSO IP_OPTIONS setsockopt system call.
CVSS Score: 6.6 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=89d7ae34cdda4195809a5a987f697a517a2a3177; http://rhn.redhat.com/errata/RHSA-2013-0496.html; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.8
CVE: CVE-2013-0311
Published: 2013-02-22
Description: The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
CVSS Score: 6.5 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2013-0496.html
CVE: CVE-2013-0313
Published: 2013-02-22
Description: The evm_update_evmxattr function in security/integrity/evm/evm_crypto.c in the Linux kernel before 3.7.5, when the Extended Verification Module (EVM) is enabled, allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via an attempted removexattr operation on an inode of a sockfs filesystem.
CVSS Score: 6.2 (MEDIUM)
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a67adb997419fb53540d4a4f79c6471c60bc69b6; http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.7.5; http://www.openwall.com/lists/oss-security/2013/02/20/16
CVE: CVE-2013-0706
Published: 2013-02-22
Description: NEC Universal RAID Utility 1.40 Rev 680 and earlier, 2.31 Rev 1492 and earlier, and 2.5 Rev 2244 and earlier does not provide access control, which allows remote attackers to perform arbitrary RAID disk operations via unspecified vectors.
CVSS Score: 9.0 (HIGH)
CWE: CWE-264
References: http://jpn.nec.com/security-info/secinfo/nv13-004.html; http://jvn.jp/en/jp/JVN75585394/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000012
CVE: CVE-2013-0730
Published: 2013-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Newscoop 4.x through 4.1.0 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) language parameter to application/modules/admin/controllers/LanguagesController.php or (2) user parameter to application/modules/admin/controllers/UserController.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://forum.sourcefabric.org/discussion/15052/security-patch-released-for-newscoop-4-1; http://secunia.com/advisories/51921; https://github.com/sourcefabric/Newscoop/commit/4f948ba3afaaeb616006cbabc85906ef3254169d
CVE: CVE-2012-6326
Published: 2013-02-22
Description: VMware vCenter Server 4.1 before Update 3 and 5.0 before Update 2, and vCSA 5.0 before Update 2, allows remote attackers to cause a denial of service (disk consumption) via vectors that trigger large log entries.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.vmware.com/security/advisories/VMSA-2012-0018.html; http://www.vmware.com/security/advisories/VMSA-2012-0018.html
CVE: CVE-2013-0465
Published: 2013-02-22
Description: Unspecified vulnerability in the IBM WebSphere Cast Iron physical and virtual appliance 6.0 and 6.1 before 6.1.0.15 and 6.3 before 6.3.0.1, when LDAP authentication is enabled, allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unknown vectors.
CVSS Score: 5.4 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1LI77155; http://www-01.ibm.com/support/docview.wss?uid=swg21623324; https://exchange.xforce.ibmcloud.com/vulnerabilities/81061
CVE: CVE-2013-1659
Published: 2013-02-22
Description: VMware vCenter Server 4.0 before Update 4b, 5.0 before Update 2, and 5.1 before 5.1.0b; VMware ESXi 3.5 through 5.1; and VMware ESX 3.5 through 4.1 do not properly implement the Network File Copy (NFC) protocol, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption) by modifying the client-server data stream.
CVSS Score: 7.6 (HIGH)
References: http://www.vmware.com/security/advisories/VMSA-2013-0003.html; http://www.vmware.com/security/advisories/VMSA-2013-0003.html
CVE: CVE-2013-0879
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly implement web audio nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.apple.com/archives/security-announce/2013/Jun/msg00001.html; http://lists.apple.com/archives/security-announce/2013/Sep/msg00006.html
CVE: CVE-2013-0880
Published: 2013-02-23
Description: Use-after-free vulnerability in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to databases.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=171951
CVE: CVE-2013-0881
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via crafted data in the Matroska container format.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=167069
CVE: CVE-2013-0882
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect memory access) or possibly have unspecified other impact via a large number of SVG parameters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=165432
CVE: CVE-2013-0883
Published: 2013-02-23
Description: Skia, as used in Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, allows remote attackers to cause a denial of service (incorrect read operation) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-787
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=142169
CVE: CVE-2013-0884
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly load Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=172984
CVE: CVE-2013-0885
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.97 on Windows and Linux, and before 25.0.1364.99 on Mac OS X, does not properly restrict API privileges during interaction with the Chrome Web Store, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-732
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=172369
CVE: CVE-2013-0886
Published: 2013-02-23
Description: Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
CVSS Score: 7.5 (HIGH)
References: http://googlechromereleases.blogspot.com/2013/02/stable-channel-update_21.html; http://lists.opensuse.org/opensuse-updates/2013-03/msg00045.html; https://code.google.com/p/chromium/issues/detail?id=171569