deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3891
Published: 2010-11-12
Description: Cross-site request forgery (CSRF) vulnerability in ESAdmin/security.do in the administrator interface in IBM OmniFind Enterprise Edition before 9.1 allows remote attackers to hijack the authentication of administrators for requests that add an administrative user via a saveNewUser action.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.exploit-db.com/exploits/15473; http://www.osvdb.org/69083
CVE: CVE-2009-5016
Published: 2010-11-12
Description: Integer overflow in the xml_utf8_decode function in ext/xml/xml.c in PHP before 5.2.11 makes it easier for remote attackers to bypass cross-site scripting (XSS) and SQL injection protection mechanisms via a crafted string that uses overlong UTF-8 encoding, a different vulnerability than CVE-2010-3870.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://bugs.php.net/bug.php?id=49687; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html
CVE: CVE-2009-5017
Published: 2010-11-12
Description: Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://hg.mozilla.org/releases/mozilla-1.9.2/rev/e42c563313a0; http://sirdarckcat.blogspot.com/2009/10/couple-of-unicode-issues-on-php-and.html; https://bugzilla.mozilla.org/show_bug.cgi?id=511859
CVE: CVE-2010-3892
Published: 2010-11-12
Description: Session fixation vulnerability in the login form in the administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x allows remote attackers to hijack web sessions by replaying a session ID (aka SID) value.
CVSS Score: 6.8 (MEDIUM)
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740
CVE: CVE-2010-3893
Published: 2010-11-12
Description: The administrator interface in IBM OmniFind Enterprise Edition 8.x and 9.x does not restrict use of a session ID (aka SID) value to a single IP address, which allows remote attackers to perform arbitrary administrative actions by leveraging cookie theft, related to a "session impersonation" issue.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740
CVE: CVE-2010-3894
Published: 2010-11-12
Description: Stack-based buffer overflow in the Java_com_ibm_es_oss_CryptionNative_ESEncrypt function in /opt/IBM/es/lib/libffq.cryptionjni.so in the login form in the administration interface in IBM OmniFind Enterprise Edition before 8.5 FP6 allows remote attackers to execute arbitrary code via a long password.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.exploit-db.com/exploits/15474; http://www.osvdb.org/69079
CVE: CVE-2010-3895
Published: 2010-11-12
Description: esRunCommand in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges by specifying an arbitrary command name as the first argument.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.exploit-db.com/exploits/15475; http://www.securityfocus.com/archive/1/514688/100/0/threaded
CVE: CVE-2010-3896
Published: 2010-11-12
Description: The ESSearchApplication directory tree in IBM OmniFind Enterprise Edition 8.x and 9.x does not require authentication, which allows remote attackers to modify the server configuration via a request to palette.do.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740
CVE: CVE-2010-3897
Published: 2010-11-12
Description: ESSearchApplication/palette.do in IBM OmniFind Enterprise Edition 8.x and 9.x includes the administrator password in the HTML source code, which might allow remote attackers to obtain sensitive information by leveraging read access to this file.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-255
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740
CVE: CVE-2010-3898
Published: 2010-11-12
Description: IBM OmniFind Enterprise Edition 8.x and 9.x does not properly restrict the cookie path of administrator (aka ESAdmin) cookies, which might allow remote attackers to bypass authentication by leveraging access to other pages on the web site.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.securityfocus.com/archive/1/514688/100/0/threaded; http://www.securityfocus.com/bid/44740
CVE: CVE-2010-3899
Published: 2010-11-12
Description: IBM OmniFind Enterprise Edition 8.x and 9.x performs web crawls with an unlimited recursion depth, which allows remote web servers to cause a denial of service (infinite loop) via a crafted series of documents.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.exploit-db.com/exploits/15476; http://www.osvdb.org/69078
CVE: CVE-2010-4236
Published: 2010-11-12
Description: Untrusted search path vulnerability in estaskwrapper in IBM OmniFind Enterprise Edition before 9.1 allows local users to gain privileges via an ES_LIBRARY_PATH environment variable and a modified PATH environment variable, which is used during execution of the estasklight program, a different vulnerability than CVE-2010-3895.
CVSS Score: 6.9 (MEDIUM)
References: http://security.fatihkilic.de/advisory/fkilic-sa-2010-ibm-omnifind.txt; http://www.exploit-db.com/exploits/15475; http://www.securityfocus.com/archive/1/514688/100/0/threaded
CVE: CVE-2010-0113
Published: 2010-11-15
Description: The Symantec Norton Mobile Security application 1.0 Beta for Android records setup details, possibly including wipe/lock credentials, in the device logs, which allows user-assisted remote attackers to obtain potentially sensitive information by leveraging the ability of a separate crafted application to read these logs.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/69253; http://www.securityfocus.com/bid/44767; http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2010&suid=20101111_00
CVE: CVE-2010-2638
Published: 2010-11-15
Description: Unspecified vulnerability in IBM WebSphere MQ 7.0 before 7.0.1.5 allows remote authenticated users to cause a denial of service (disk consumption) via vectors that trigger an FDC with an RM680004 Probe Id value.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IC71123; https://exchange.xforce.ibmcloud.com/vulnerabilities/63147; http://www-01.ibm.com/support/docview.wss?uid=swg1IC71123
CVE: CVE-2010-2892
Published: 2010-11-15
Description: gsb/drivers.php in LANDesk Management Gateway 4.0 through 4.0-1.48 and 4.2 through 4.2-1.8 allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the DRIVES parameter, as demonstrated by a cross-site request forgery (CSRF) attack.
CVSS Score: 8.5 (HIGH)
CWE: CWE-20
References: http://community.landesk.com/support/docs/DOC-21767; http://secunia.com/advisories/42188; http://securitytracker.com/id?1024728
CVE: CVE-2010-1378
Published: 2010-11-15
Description: OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certificate authentication via an arbitrary certificate issued by a legitimate Certification Authority.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-295
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-1803
Published: 2010-11-15
Description: Time Machine in Apple Mac OS X 10.6.x before 10.6.5 does not verify the unique identifier of its remote AFP volume, which allows remote attackers to obtain sensitive information by spoofing this volume.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1828
Published: 2010-11-15
Description: AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon restart) via crafted reconnect authentication packets.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1829
Published: 2010-11-15
Description: Directory traversal vulnerability in AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to execute arbitrary code by creating files that are outside the bounds of a share.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-22
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1830
Published: 2010-11-15
Description: AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 generates different error messages depending on whether a share exists, which allows remote attackers to enumerate valid share names via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1831
Published: 2010-11-15
Description: Buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code via a long name of an embedded font in a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1832
Published: 2010-11-15
Description: Stack-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code via a crafted embedded font in a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1833
Published: 2010-11-15
Description: Apple Type Services (ATS) in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted embedded font in a document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1834
Published: 2010-11-15
Description: CFNetwork in Apple Mac OS X 10.6.x before 10.6.5 does not properly validate the domains of cookies, which makes it easier for remote web servers to track users by setting a cookie that is associated with a partial IP address.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1836
Published: 2010-11-15
Description: Stack-based buffer overflow in CoreGraphics in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1837
Published: 2010-11-15
Description: CoreText in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted font in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/bid/44808
CVE: CVE-2010-1838
Published: 2010-11-15
Description: Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly handle errors associated with disabled mobile accounts, which allows remote attackers to bypass authentication by providing a valid account name.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-287
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/bid/44817
CVE: CVE-2010-1840
Published: 2010-11-15
Description: Stack-based buffer overflow in the password-validation functionality in Directory Services in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1841
Published: 2010-11-15
Description: Disk Images in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted UDIF image.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/bid/44815
CVE: CVE-2010-1842
Published: 2010-11-15
Description: Buffer overflow in AppKit in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a bidirectional text string with ellipsis truncation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/bid/44803
CVE: CVE-2010-1843
Published: 2010-11-16
Description: Networking in Apple Mac OS X 10.6.2 through 10.6.4 allows remote attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted PIM packet.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00003.html; http://secunia.com/advisories/42314
CVE: CVE-2010-1844
Published: 2010-11-16
Description: Unspecified vulnerability in Image Capture in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to cause a denial of service (memory consumption and system crash) via a crafted image.
CVSS Score: 7.1 (HIGH)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/bid/44813
CVE: CVE-2010-1845
Published: 2010-11-16
Description: ImageIO in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted PSD image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securityfocus.com/archive/1/514867/100/0/threaded
CVE: CVE-2010-1846
Published: 2010-11-16
Description: Heap-based buffer overflow in Image RAW in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted RAW image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-1847
Published: 2010-11-16
Description: The kernel in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform memory management associated with terminal devices, which allows local users to cause a denial of service (system crash) via unspecified vectors.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-3783
Published: 2010-11-16
Description: Password Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly perform replication, which allows remote authenticated users to bypass verification of the current password via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-3784
Published: 2010-11-16
Description: The PMPageFormatCreateWithDataRepresentation API in Printing in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 does not properly handle XML data, which allows attackers to cause a denial of service (NULL pointer dereference and application crash) via unspecified API calls.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435; http://www.securitytracker.com/id?1024723
CVE: CVE-2010-3785
Published: 2010-11-16
Description: Buffer overflow in QuickLook in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Microsoft Office document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00006.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3786
Published: 2010-11-16
Description: QuickLook in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Excel file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=881; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00006.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html
CVE: CVE-2010-3787
Published: 2010-11-16
Description: Heap-based buffer overflow in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3788
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of JP2 image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted JP2 file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3789
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted AVI file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3790
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file that causes an image sample transformation to scale a sprite outside a buffer boundary.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
CVE: CVE-2010-3791
Published: 2010-11-16
Description: Buffer overflow in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3792
Published: 2010-11-16
Description: Integer signedness error in QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted MPEG movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3793
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted Sorenson movie file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3794
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of FlashPix image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted FlashPix file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435
CVE: CVE-2010-3795
Published: 2010-11-16
Description: QuickTime in Apple Mac OS X 10.6.x before 10.6.5 accesses uninitialized memory locations during processing of GIF image data, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted GIF file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://lists.apple.com/archives/security-announce/2010//Nov/msg00000.html; http://support.apple.com/kb/HT4435