deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0431
Published: 2011-02-19
Description: The afs_linux_lock function in afs/LINUX/osi_vnodeops.c in the kernel module in OpenAFS 1.4.14, 1.4.12, 1.4.7, and possibly other versions does not properly handle errors, which allows attackers to cause a denial of service via unknown vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/43371; http://secunia.com/advisories/43407; http://www.debian.org/security/2011/dsa-2168
CVE: CVE-2011-0706
Published: 2011-02-19
Description: The JNLPClassLoader class in IcedTea-Web before 1.0.1, as used in OpenJDK Runtime Environment 1.6.0, allows remote attackers to gain privileges via unknown vectors related to multiple signers and the assignment of "an inappropriate security descriptor."
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://dbhole.wordpress.com/2011/02/15/icedtea-web-1-0-1-released/; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054115.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054134.html
CVE: CVE-2011-0721
Published: 2011-02-19
Description: Multiple CRLF injection vulnerabilities in (1) chfn and (2) chsh in shadow 1:4.1.4 allow local users to add new users or groups to /etc/passwd via the GECOS field.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://osvdb.org/70895; http://secunia.com/advisories/42505; http://secunia.com/advisories/43345
CVE: CVE-2011-0724
Published: 2011-02-19
Description: The Live DVD for Edubuntu 9.10, 10.04 LTS, and 10.10 does not correctly regenerate iTALC private keys after installation, which causes each installation to have the same fixed key, which allows remote attackers to gain privileges.
CVSS Score: 9.3 (HIGH)
CWE: CWE-310
References: http://www.securityfocus.com/bid/46346; http://www.ubuntu.com/usn/USN-1061-1; http://www.vupen.com/english/advisories/2011/0378
CVE: CVE-2011-1000
Published: 2011-02-19
Description: jingle-factory.c in Telepathy Gabble 0.11 before 0.11.7, 0.10 before 0.10.5, and 0.8 before 0.8.15 allows remote attackers to sniff audio and video calls via a crafted google:jingleinfo stanza that specifies an alternate server for streamed media.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054324.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054409.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054575.html
CVE: CVE-2011-1035
Published: 2011-02-19
Description: The password reset in PivotX before 2.2.4 allows remote attackers to modify the passwords of arbitrary users via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://blog.pivotx.net/2011-02-16/pivotx-225-released; http://forum.pivotx.net/viewtopic.php?f=2&t=1961; http://forum.pivotx.net/viewtopic.php?f=2&t=1967
CVE: CVE-2011-0329
Published: 2011-02-21
Description: Directory traversal vulnerability in the GetData method in the Dell DellSystemLite.Scanner ActiveX control in DellSystemLite.ocx 1.0.0.0 allows remote attackers to read arbitrary files via directory traversal sequences in the fileID parameter.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://secunia.com/advisories/42880; http://secunia.com/secunia_research/2011-10/; http://www.securityfocus.com/bid/46443
CVE: CVE-2011-0330
Published: 2011-02-21
Description: The Dell DellSystemLite.Scanner ActiveX control in DellSystemLite.ocx 1.0.0.0 does not properly restrict the values of the WMIAttributesOfInterest property, which allows remote attackers to execute arbitrary WMI Query Language (WQL) statements via a crafted value, as demonstrated by a value that triggers disclosure of information about installed software.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/42880; http://secunia.com/secunia_research/2011-11/; http://www.securityfocus.com/bid/46443
CVE: CVE-2011-0448
Published: 2011-02-21
Description: Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for remote attackers to conduct SQL injection attacks via a non-numeric argument.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://groups.google.com/group/rubyonrails-security/msg/4e19864cf6ad40ad?dmode=source&output=gplain; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html; http://secunia.com/advisories/43278
CVE: CVE-2011-0449
Published: 2011-02-21
Description: actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html; http://secunia.com/advisories/43278
CVE: CVE-2011-0694
Published: 2011-02-21
Description: RealNetworks RealPlayer 11.0 through 11.1, SP 1.0 through 1.1.5, and 14.0.0 through 14.0.1, and Enterprise 2.0 through 2.1.4, uses predictable names for temporary files, which allows remote attackers to conduct cross-domain scripting attacks and execute arbitrary code via the OpenURLinPlayerBrowser function.
CVSS Score: 9.3 (HIGH)
References: http://docs.real.com/docs/security/SecurityUpdate020811RPE.pdf; http://osvdb.org/70849; http://secunia.com/advisories/43268
CVE: CVE-2011-1045
Published: 2011-02-21
Description: Unspecified vulnerability in the Rendition Engine (aka P8RE) 4.0.1 through 4.5.1 in IBM FileNet P8 Content Manager (CM) allows remote attackers to gain privileges via unknown vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://secunia.com/advisories/43321; http://www-01.ibm.com/support/docview.wss?uid=swg21462440; http://www.securityfocus.com/bid/46424
CVE: CVE-2011-1046
Published: 2011-02-21
Description: IBM FileNet P8 Content Engine (aka P8CE) 4.0.1 through 5.0.0, as used in FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), does not require the PRIVILEGED_WRITE access role for all intended Object Store modifications, which allows remote attackers to change a privileged property of an object via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/43347; http://www-01.ibm.com/support/docview.wss?uid=swg21462438; http://www.securityfocus.com/bid/46432
CVE: CVE-2010-4745
Published: 2011-02-21
Description: Cross-site scripting (XSS) vulnerability in nav.html in PHPXref before 0.7.1 allows remote attackers to inject arbitrary web script or HTML via the query string.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70855; http://phpxref.sourceforge.net/Changelog; http://secunia.com/advisories/42069
CVE: CVE-2011-1047
Published: 2011-02-21
Description: Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70993; http://osvdb.org/70994; http://secunia.com/advisories/43306
CVE: CVE-2011-1048
Published: 2011-02-21
Description: SQL injection vulnerability in product.php in MihanTools 1.33 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/70858; http://secunia.com/advisories/43195; http://www.exploit-db.com/exploits/16143
CVE: CVE-2011-1049
Published: 2011-02-21
Description: Buffer overflow in the Mach-O input file loader in Hex-Rays IDA Pro 5.7 and 6.0 allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted Macho-O file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://osvdb.org/70846; http://secunia.com/advisories/43190; http://www.vupen.com/english/advisories/2011/0357
CVE: CVE-2011-1050
Published: 2011-02-21
Description: Unspecified vulnerability in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to "converson of string encodings" and "inconsistencies in the handling of UTF8 sequences by the user interface."
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/46525; http://www.vupen.com/english/advisories/2011/0357; https://exchange.xforce.ibmcloud.com/vulnerabilities/65562
CVE: CVE-2011-1051
Published: 2011-02-21
Description: Integer overflow in the COFF/EPOC/EXPLOAD input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/46525; https://exchange.xforce.ibmcloud.com/vulnerabilities/65561; https://www.hex-rays.com/vulnfix.shtml
CVE: CVE-2011-1052
Published: 2011-02-21
Description: Integer overflow in the PSX/GEOS input file loaders in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors related to memory allocation.
CVSS Score: 10.0 (HIGH)
CWE: CWE-189
References: http://www.securityfocus.com/bid/46525; https://exchange.xforce.ibmcloud.com/vulnerabilities/65560; https://www.hex-rays.com/vulnfix.shtml
CVE: CVE-2011-1053
Published: 2011-02-21
Description: Unspecified vulnerability in the Mach-O input file loader in Hex-Rays IDA Pro 5.7 and 6.0 allows user-assisted remote attackers to cause a denial of service (out-of-memory exception and inability to analyze code) via a crafted Mach-O file.
CVSS Score: 4.3 (MEDIUM)
References: http://www.securityfocus.com/bid/46525; https://exchange.xforce.ibmcloud.com/vulnerabilities/65559; https://www.hex-rays.com/vulnfix.shtml
CVE: CVE-2011-1054
Published: 2011-02-21
Description: Unspecified vulnerability in the PEF input file loader in Hex-Rays IDA Pro 5.7 and 6.0 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://www.securityfocus.com/bid/46525; https://exchange.xforce.ibmcloud.com/vulnerabilities/65558; https://www.hex-rays.com/vulnfix.shtml
CVE: CVE-2011-1055
Published: 2011-02-21
Description: SQL injection vulnerability in api/ice_media.cfc in Lingxia I.C.E CMS 1.0 allows remote attackers to execute arbitrary SQL commands via the session.user_id parameter to media.cfm.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/43327; http://www.exploit-db.com/exploits/16171; http://www.securityfocus.com/bid/46373
CVE: CVE-2011-1056
Published: 2011-02-21
Description: The installer for Metasploit Framework 3.5.1, when running on Windows, uses weak inherited permissions for the Metasploit installation directory, which allows local users to gain privileges by replacing critical files with a Trojan horse.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://blog.metasploit.com/2011/02/metasploit-framework-352-released.html; http://osvdb.org/70857; http://secunia.com/advisories/43166
CVE: CVE-2011-1057
Published: 2011-02-21
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1056.  Reason: This candidate is a duplicate of CVE-2011-1056.  Notes: All CVE users should reference CVE-2011-1056 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-1058
Published: 2011-02-22
Description: Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when "format rst" is set, allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute.  NOTE: some of these details are obtained from third party information.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054544.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055116.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055124.html
CVE: CVE-2011-0530
Published: 2011-02-22
Description: Buffer overflow in the mainloop function in nbd-server.c in the server in Network Block Device (nbd) before 2.9.20 might allow remote attackers to execute arbitrary code via a long request.  NOTE: this issue exists because of a CVE-2005-3534 regression.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=611187; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054071.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-February/054083.html
CVE: CVE-2011-0634
Published: 2011-02-22
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2011-1002.  Reason: This candidate is a reservation duplicate of CVE-2011-1002.  Notes: All CVE users should reference CVE-2011-1002 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2011-0707
Published: 2011-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056363.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056387.html
CVE: CVE-2011-1002
Published: 2011-02-22
Description: avahi-core/socket.c in avahi-daemon in Avahi before 0.6.29 allows remote attackers to cause a denial of service (infinite loop) via an empty mDNS (1) IPv4 or (2) IPv6 UDP packet to port 5353.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2010-2244.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-835
References: http://avahi.org/ticket/325; http://git.0pointer.de/?p=avahi.git%3Ba=commit%3Bh=46109dfec75534fe270c0ab902576f685d5ab3a6; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055858.html
CVE: CVE-2011-1038
Published: 2011-02-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in stconf.nsf in the server in IBM Lotus Sametime 8.0.1 allow remote attackers to inject arbitrary web script or HTML via (1) the messageString parameter in a WebMessage action or (2) the PATH_INFO.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43430; http://securityreason.com/securityalert/8100; http://www.securityfocus.com/archive/1/516563/100/0/threaded
CVE: CVE-2011-1059
Published: 2011-02-22
Description: Use-after-free vulnerability in WebCore in WebKit before r77705, as used in Google Chrome before 11.0.672.2 and other products, allows user-assisted remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via vectors that entice a user to resubmit a form, related to improper handling of provisional items by the HistoryController component, aka rdar problem 8938557.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=70315; http://googlechromereleases.blogspot.com/2011/02/dev-channel-update_17.html; http://trac.webkit.org/changeset/77705
CVE: CVE-2011-1060
Published: 2011-02-23
Description: SQL injection vulnerability in the member function in classes/member.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the wsnuser cookie to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/174/summary.html; http://secunia.com/advisories/43374; http://securityreason.com/securityalert/8101
CVE: CVE-2011-1061
Published: 2011-02-23
Description: SQL injection vulnerability in memberlist.php in WSN Guest 1.24 allows remote attackers to execute arbitrary SQL commands via the time parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://evuln.com/vulns/175/summary.html; http://packetstormsecurity.org/files/view/98573/wsnguest124-sql.txt; http://securityreason.com/securityalert/8102
CVE: CVE-2011-1062
Published: 2011-02-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext, (2) sort, (3) dir, and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/70877; http://osvdb.org/70878; http://secunia.com/advisories/43318
CVE: CVE-2011-1063
Published: 2011-02-23
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cherry-Design Photopad 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) data[title] parameters in an edit action to files.php, or (3) id parameter in a view action to gallery.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/43348; http://securityreason.com/securityalert/8103; http://www.htbridge.ch/advisory/multiple_xss_vulnerabilities_in_photopad.html
CVE: CVE-2011-1064
Published: 2011-02-23
Description: SQL injection vulnerability in member/list.php in qibosoft Qi Bo CMS 7 allows remote attackers to execute arbitrary SQL commands via the aidDB[] parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://bbs.wolvez.org/viewtopic.php?id=211; http://secunia.com/advisories/43396; http://www.securityfocus.com/bid/46445
CVE: CVE-2011-1065
Published: 2011-02-23
Description: Multiple stack-based buffer overflows in the PIPIWebPlayer ActiveX control (PIWebPlayer.ocx) in PIPI Player 2.8.0.0 allow remote attackers to execute arbitrary code via long arguments to the (1) PlayURL or (2) PlayURLWithLocalPlayer methods.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43394; http://www.securityfocus.com/bid/46468; http://www.wooyun.org/bugs/wooyun-2010-01382
CVE: CVE-2011-1066
Published: 2011-02-23
Description: Cross-site scripting (XSS) vulnerability in the Messaging module 6.x-2.x before 6.x-2.4 and 6.x-4.x before 6.x-4.0-beta8 for Drupal allows remote attackers with administer messaging permissions to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 2.6 (LOW)
CWE: CWE-79
References: http://drupal.org/node/1064024; http://osvdb.org/70933; http://secunia.com/advisories/43385
CVE: CVE-2010-4746
Published: 2011-02-23
Description: Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of service (memory consumption) via "badly behaved applications," related to (1) Slapi_Attr mishandling in the DN normalization code and (2) pointer mishandling in the syntax normalization code, a different issue than CVE-2011-0019.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://directory.fedoraproject.org/wiki/Release_Notes; https://bugzilla.redhat.com/show_bug.cgi?id=663597; http://directory.fedoraproject.org/wiki/Release_Notes
CVE: CVE-2011-0019
Published: 2011-02-23
Description: slapd (aka ns-slapd) in 389 Directory Server 1.2.7.5 (aka Red Hat Directory Server 8.2.x or dirsrv) does not properly handle simple paged result searches, which allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via multiple search requests.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://www.redhat.com/support/errata/RHSA-2011-0293.html; http://www.securityfocus.com/bid/46489; http://www.securitytracker.com/id?1025102
CVE: CVE-2011-0022
Published: 2011-02-23
Description: The setup scripts in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x), when multiple unprivileged instances are configured, use 0777 permissions for the /var/run/dirsrv directory, which allows local users to cause a denial of service (daemon outage or arbitrary process termination) by replacing PID files contained in this directory.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://www.redhat.com/support/errata/RHSA-2011-0293.html; http://www.securityfocus.com/bid/46489; http://www.securitytracker.com/id?1025102
CVE: CVE-2011-0414
Published: 2011-02-23
Description: ISC BIND 9.7.1 through 9.7.2-P3, when configured as an authoritative server, allows remote attackers to cause a denial of service (deadlock and daemon hang) by sending a query at the time of (1) an IXFR transfer or (2) a DDNS update.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://secunia.com/advisories/43439; http://secunia.com/advisories/43443
CVE: CVE-2011-0532
Published: 2011-02-23
Description: The (1) backup and restore scripts, (2) main initialization script, and (3) ldap-agent script in 389 Directory Server 1.2.x (aka Red Hat Directory Server 8.2.x) place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-264
References: http://www.redhat.com/support/errata/RHSA-2011-0293.html; http://www.securityfocus.com/bid/46489; http://www.securitytracker.com/id?1025102
CVE: CVE-2011-0725
Published: 2011-02-23
Description: Absolute path traversal vulnerability in the org.debian.apt.UpdateCachePartially method in worker.py in Aptdaemon 0.40 in Ubuntu 10.10 and 11.04 allows local users to read arbitrary files via a full pathname in the sources_list argument, related to the D-Bus interface.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-22
References: http://www.securityfocus.com/bid/46490; http://www.securitytracker.com/id?1025107; http://www.ubuntu.com/usn/USN-1068-1
CVE: CVE-2011-0999
Published: 2011-02-23
Description: mm/huge_memory.c in the Linux kernel before 2.6.38-rc5 does not prevent creation of a transparent huge page (THP) during the existence of a temporary stack for an exec system call, which allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact via a crafted application.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a7d6e4ecdb7648478ddec76d30d87d03d6e22b31; http://openwall.com/lists/oss-security/2011/02/17/3; http://openwall.com/lists/oss-security/2011/02/17/6
CVE: CVE-2011-1003
Published: 2011-02-23
Description: Double free vulnerability in the vba_read_project_strings function in vba_extract.c in libclamav in ClamAV before 0.97 might allow remote attackers to execute arbitrary code via crafted Visual Basic for Applications (VBA) data in a Microsoft Office document.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob%3Bf=ChangeLog%3Bhb=clamav-0.97; http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=commit%3Bh=d21fb8d975f8c9688894a8cef4d50d977022e09f; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/055771.html
CVE: CVE-2011-1067
Published: 2011-02-23
Description: slapd (aka ns-slapd) in 389 Directory Server before 1.2.8.a2 does not properly manage the c_timelimit field of the connection table element, which allows remote attackers to cause a denial of service (daemon outage) via Simple Paged Results connections, as demonstrated by using multiple processes to replay TCP sessions, a different vulnerability than CVE-2011-0019.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://directory.fedoraproject.org/wiki/Release_Notes; http://secunia.com/advisories/43566; https://bugzilla.redhat.com/show_bug.cgi?id=668619