deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3495
Published: 2010-10-19
Description: Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-362
References: http://bugs.python.org/issue6706; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html; http://pypi.python.org/pypi/ZODB3/3.10.0#id1
CVE: CVE-2010-3975
Published: 2010-10-19
Description: Untrusted search path vulnerability in Adobe Flash Player 9 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse schannel.dll that is located in the same folder as a file that is processed by Flash.
CVSS Score: 9.3 (HIGH)
References: http://www.securityfocus.com/archive/1/513397; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12212; http://www.securityfocus.com/archive/1/513397
CVE: CVE-2010-3976
Published: 2010-10-19
Description: Untrusted search path vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a file that is processed by Flash Player.
CVSS Score: 9.3 (HIGH)
References: http://core.yehg.net/lab/pr0js/advisories/dll_hijacking/%5Bflash_player%5D_10.1.x_insecure_dll_hijacking_%28dwmapi.dll%29; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00002.html
CVE: CVE-2010-3541
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
CVSS Score: 5.1 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3548
Published: 2010-10-19
Description: Unspecified vulnerability in the Java Naming and Directory Interface (JNDI) component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to determine internal IP addresses or "otherwise-protected internal network names."
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3549
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is an HTTP request splitting vulnerability involving the handling of the chunked transfer encoding method by the HttpURLConnection class.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3550
Published: 2010-10-19
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3551
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3552
Published: 2010-10-19
Description: Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3553
Published: 2010-10-19
Description: Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to unsafe reflection involving the UIDefault.ProxyLazyValue class.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3554
Published: 2010-10-19
Description: Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to "permissions granted to certain system objects."
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3555
Published: 2010-10-19
Description: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from a reliable third party coordinator that the ActiveX Plugin does not properly initialize an object field that is used as a window handle, which allows attackers to execute arbitrary code.
CVSS Score: 9.3 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3556
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
CVE: CVE-2010-3557
Published: 2010-10-19
Description: Unspecified vulnerability in the Swing component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to the modification of "behavior and state of certain JDK classes" and "mutable static."
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3558
Published: 2010-10-19
Description: Unspecified vulnerability in the Java Web Start component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3559
Published: 2010-10-19
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this involves an incorrect sign extension in the HeadspaceSoundbank.nGetName function, which allows attackers to execute arbitrary code via a crafted BANK record that leads to a buffer overflow.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3560
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality via unknown vectors.
CVSS Score: 2.6 (LOW)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3561
Published: 2010-10-19
Description: Unspecified vulnerability in the CORBA component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this involves the use of the privileged accept method in the ServerSocket class, which does not limit which hosts can connect and allows remote attackers to bypass intended network access restrictions.
CVSS Score: 7.5 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3562
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is a double free vulnerability in IndexColorModel that allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3563
Published: 2010-10-19
Description: Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to "how Web Start retrieves security policies," BasicServiceImpl, and forged policies that bypass sandbox restrictions.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3565
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow that triggers memory corruption via large values in a subsample of a JPEG image, related to JPEGImageWriter.writeImage in the imageio API.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3566
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update and 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow that leads to a buffer overflow via a crafted devs (device information) tag structure in a color profile.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3567
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to a calculation error in right-to-left text character counts for the ICU OpenType font rendering implementation, which triggers an out-of-bounds memory access.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3568
Published: 2010-10-19
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is a race condition related to deserialization.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3569
Published: 2010-10-19
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, and 1.4.2_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this allows remote attackers to execute arbitrary code by causing the defaultReadObject method in the Serialization API to set a volatile field multiple times.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3570
Published: 2010-10-19
Description: Unspecified vulnerability in the Deployment Toolkit component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 7.6 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]2253&w=2
CVE: CVE-2010-3571
Published: 2010-10-19
Description: Unspecified vulnerability in the 2D component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an integer overflow in the color profile parser that allows remote attackers to execute arbitrary code via a crafted Tag structure in a color profile.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
CVE: CVE-2010-3572
Published: 2010-10-19
Description: Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html; http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00005.html
CVE: CVE-2010-3573
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.
CVSS Score: 5.1 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-3574
Published: 2010-10-19
Description: Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21, 5.0 Update 25, 1.4.2_27, and 1.3.1_28 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that HttpURLConnection does not properly check for the allowHttpTrace permission, which allows untrusted code to perform HTTP TRACE requests.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c02616748; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049455.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049528.html
CVE: CVE-2010-0782
Published: 2010-10-20
Description: IBM WebSphere MQ 6.x before 6.0.2.10 and 7.x before 7.0.1.3 allows remote attackers to spoof X.509 certificate authentication, and send or receive channel messages, via a crafted Subject Distinguished Name (DN) value in a certificate.
CVSS Score: 4.3 (MEDIUM)
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IZ68707; http://www-01.ibm.com/support/docview.wss?uid=swg27014224; https://exchange.xforce.ibmcloud.com/vulnerabilities/60018
CVE: CVE-2010-2057
Published: 2010-10-20
Description: shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: http://svn.apache.org/viewvc/myfaces/shared/trunk/core/src/main/java/org/apache/myfaces/shared/util/StateUtils.java?r1=943327&r2=951801; https://bugzilla.redhat.com/show_bug.cgi?id=623799; https://issues.apache.org/jira/browse/MYFACES-2749
CVE: CVE-2010-3349
Published: 2010-10-20
Description: Ardour 2.8.11 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598283; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049333.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049373.html