deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-3357
Published: 2008-08-05
Description: Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-426
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=733; http://secunia.com/advisories/31357; http://secunia.com/advisories/31398
CVE: CVE-2008-3389
Published: 2008-08-05
Description: Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=732; http://secunia.com/advisories/31357; http://secunia.com/advisories/31398
CVE: CVE-2008-3431
Published: 2008-08-05
Description: The VBoxDrvNtDeviceControl function in VBoxDrv.sys in Sun xVM VirtualBox before 1.6.4 uses the METHOD_NEITHER communication method for IOCTLs and does not properly validate a buffer associated with the Irp object, which allows local users to gain privileges by opening the \\.\VBoxDrv device and calling DeviceIoControl to send a crafted kernel address.
CVSS Score: 8.8 (HIGH)
References: http://secunia.com/advisories/31361; http://securityreason.com/securityalert/4107; http://securitytracker.com/id?1020625
CVE: CVE-2008-3481
Published: 2008-08-05
Description: themes/sample/theme.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier allows remote attackers to obtain sensitive information via a direct request, which reveals the installation path in an error message.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://securityreason.com/securityalert/4108; https://www.exploit-db.com/exploits/6178; http://securityreason.com/securityalert/4108
CVE: CVE-2008-3482
Published: 2008-08-05
Description: Cross-site scripting (XSS) vulnerability in the error page feature in Panasonic Network Camera BL-C111, BL-C131, BB-HCM511, BB-HCM531, BB-HCM580, BB-HCM581, BB-HCM527, and BB-HCM515 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN33706820/index.html; http://jvndb.jvn.jp/contents/ja/2008/JVNDB-2008-000037.html; http://panasonic.net/pcc/support/netwkcam/support/info_xss.html
CVE: CVE-2008-3483
Published: 2008-08-05
Description: Cross-site scripting (XSS) vulnerability in ScrewTurn Wiki 2.0.29 and 2.0.30 allows remote attackers to inject arbitrary web script or HTML via error messages in the "/admin.aspx - System Log" page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31242; http://www.portcullis.co.uk/281.php; http://www.screwturn.eu/Wiki.ashx#History_2
CVE: CVE-2008-3484
Published: 2008-08-05
Description: SQL injection vulnerability in eStoreAff 0.1 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a showcat action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4109; http://www.securityfocus.com/bid/30502; https://exchange.xforce.ibmcloud.com/vulnerabilities/44166
CVE: CVE-2008-3485
Published: 2008-08-06
Description: Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://securityreason.com/securityalert/4110; http://www.securityfocus.com/archive/1/494952/100/0/threaded; http://www.securityfocus.com/bid/30446
CVE: CVE-2008-3486
Published: 2008-08-06
Description: Directory traversal vulnerability in the user_get_profile function in include/functions.inc.php in Coppermine Photo Gallery (CPG) 1.4.18 and earlier, when the charset is utf-8, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang part of serialized data in an _data cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/31295; http://securityreason.com/securityalert/4108; http://www.securityfocus.com/bid/30480
CVE: CVE-2008-3487
Published: 2008-08-06
Description: SQL injection vulnerability in profile.php in PHPAuction GPL Enhanced 2.51 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4111; http://www.securityfocus.com/bid/30501; https://exchange.xforce.ibmcloud.com/vulnerabilities/44239
CVE: CVE-2008-3488
Published: 2008-08-06
Description: Unspecified vulnerability in Novell iManager before 2.7 SP1 (2.7.1) allows remote attackers to delete Plug-in Studio created Property Book Pages via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31333; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5031820.html; http://www.securityfocus.com/bid/30497
CVE: CVE-2008-3489
Published: 2008-08-06
Description: SQL injection vulnerability in checkCookie function in includes/functions.inc.php in PHPX 3.5.16 allows remote attackers to execute arbitrary SQL commands via a PXL cookie.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4112; http://www.securityfocus.com/bid/30478; https://exchange.xforce.ibmcloud.com/vulnerabilities/44240
CVE: CVE-2008-3490
Published: 2008-08-06
Description: SQL injection vulnerability in members/mail.php in E-topbiz Online Dating 3 1.0 allows remote authenticated users to execute arbitrary SQL commands via the mail_id parameter in a veiw action.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/31346; http://securityreason.com/securityalert/4113; http://www.securityfocus.com/bid/30503
CVE: CVE-2008-3491
Published: 2008-08-06
Description: SQL injection vulnerability in go.php in Scripts24 iPost 1.0.1 and iTGP 1.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter in a report action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/47333; http://secunia.com/advisories/31344; http://secunia.com/advisories/31345
CVE: CVE-2008-2939
Published: 2008-08-06
Description: Cross-site scripting (XSS) vulnerability in proxy_ftp.c in the mod_proxy_ftp module in Apache 2.0.63 and earlier, and mod_proxy_ftp.c in the mod_proxy_ftp module in Apache 2.2.9 and earlier 2.2 versions, allows remote attackers to inject arbitrary web script or HTML via a wildcard in the last directory component in the pathname in an FTP URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://lists.apple.com/archives/security-announce/2009/May/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]3823&w=2
CVE: CVE-2008-3492
Published: 2008-08-06
Description: America's Army (aka AA or Army Game Project) 2.8.3.1 and earlier allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted UDP packet, probably involving a VoiceIndex value that is outside of the range specified by VOICE_MAX_CHATTERS.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://aluigi.altervista.org/adv/armynchia-adv.txt; http://aluigi.org/poc/armynchia.zip; http://secunia.com/advisories/31353
CVE: CVE-2008-3493
Published: 2008-08-06
Description: vncviewer.exe in RealVNC Windows Client 4.1.2.0 allows remote VNC servers to cause a denial of service (application crash) via a crafted frame buffer update packet.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://www.securityfocus.com/bid/30499; https://exchange.xforce.ibmcloud.com/vulnerabilities/44218; https://www.exploit-db.com/exploits/6181
CVE: CVE-2008-3494
Published: 2008-08-06
Description: 8e6 R3000 Internet Filter 2.0.12.10 allows remote attackers to bypass intended restrictions via an extra HTTP Host header with additional leading text placed before the real Host header.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/31391; http://www.securityfocus.com/archive/1/495117/100/0/threaded; http://www.securityfocus.com/bid/30541
CVE: CVE-2008-3495
Published: 2008-08-06
Description: SQL injection vulnerability in kategori.asp in Pcshey Portal allows remote attackers to execute arbitrary SQL commands via the kid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://downloads.securityfocus.com/vulnerabilities/exploits/30534.pl; http://www.securityfocus.com/bid/30534; https://exchange.xforce.ibmcloud.com/vulnerabilities/44213
CVE: CVE-2008-3496
Published: 2008-08-06
Description: Buffer overflow in format descriptor parsing in the uvc_parse_format function in drivers/media/video/uvc/uvc_driver.c in uvcvideo in the video4linux (V4L) implementation in the Linux kernel before 2.6.26.1 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-120
References: http://lists.opensuse.org/opensuse-security-announce/2008-09/msg00004.html; http://lkml.org/lkml/2008/7/30/655; http://secunia.com/advisories/31982
CVE: CVE-2008-3497
Published: 2008-08-06
Description: SQL injection vulnerability in pages.php in MyPHP CMS 0.3.1 allows remote attackers to execute arbitrary SQL commands via the pid parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://securityreason.com/securityalert/4115; http://www.securityfocus.com/bid/29940; http://www.vupen.com/english/advisories/2008/1953/references
CVE: CVE-2008-3498
Published: 2008-08-06
Description: SQL injection vulnerability in the nBill (com_netinvoice) component 1.2.0 SP1 for Joomla! allows remote attackers to execute arbitrary SQL commands via the cid parameter in an orders action to index.php.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/30752; http://securityreason.com/securityalert/4114; http://www.nbill.co.uk/forum-smf/index.php/topic%2C716.0.html
CVE: CVE-2008-3499
Published: 2008-08-06
Description: Unspecified vulnerability in "a page in the workarea folder" in Ektron CMS400.NET 7.00 through 7.04 and 7.50 through 7.52 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://dev.ektron.com/kb_article.aspx?id=18294; http://secunia.com/advisories/30858; https://exchange.xforce.ibmcloud.com/vulnerabilities/44488
CVE: CVE-2008-3500
Published: 2008-08-06
Description: Cross-site scripting (XSS) vulnerability in the Suggested Terms module 5.x before 5.x-1.2 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via crafted Taxonomy terms.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://drupal.org/node/274919; http://secunia.com/advisories/30846; http://www.securityfocus.com/bid/29953
CVE: CVE-2008-3501
Published: 2008-08-06
Description: Cross-site scripting (XSS) vulnerability in the WebAccess simple interface in Novell Groupwise 7.0.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/30839; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028200.html; http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028303.html
CVE: CVE-2008-3502
Published: 2008-08-06
Description: Unspecified vulnerability in Best Practical Solutions RT 3.0.0 through 3.6.6 allows remote authenticated users to cause a denial of service (CPU or memory consumption) via unspecified vectors related to the Devel::StackTrace module for Perl.
CVSS Score: 4.0 (MEDIUM)
References: http://lists.bestpractical.com/pipermail/rt-announce/2008-June/000158.html; http://secunia.com/advisories/30830; http://www.securityfocus.com/bid/29925
CVE: CVE-2008-3503
Published: 2008-08-06
Description: RSSFromParent in Plain Black WebGUI before 7.5.13 does not restrict view access to Collaboration System (CS) RSS feeds, which allows remote attackers to obtain sensitive information (CS data).
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://secunia.com/advisories/30782; http://www.securityfocus.com/bid/29927; http://www.vupen.com/english/advisories/2008/1932/references
CVE: CVE-2008-3504
Published: 2008-08-06
Description: Unspecified vulnerability in mask PHP File Manager (mPFM) before 2.3 has unknown impact and remote attack vectors related to "manipulation of cookies."
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/30833; http://sourceforge.net/project/shownotes.php?release_id=608915; http://www.securityfocus.com/bid/29926
CVE: CVE-2008-3505
Published: 2008-08-06
Description: Cross-site scripting (XSS) vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to inject arbitrary web script or HTML via the nr parameter to the default URI.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/4116; http://www.securityfocus.com/bid/29975; https://exchange.xforce.ibmcloud.com/vulnerabilities/43372
CVE: CVE-2008-3506
Published: 2008-08-06
Description: SQL injection vulnerability in PolyPager 1.0 rc2 and earlier allows remote attackers to execute arbitrary SQL commands via the nr parameter to the default URI.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://securityreason.com/securityalert/4116; http://www.securityfocus.com/bid/29972; https://exchange.xforce.ibmcloud.com/vulnerabilities/43371
CVE: CVE-2008-3507
Published: 2008-08-07
Description: SQL injection vulnerability in index.php in LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to execute arbitrary SQL commands via the id parameter in a view action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/bid/30575; https://exchange.xforce.ibmcloud.com/vulnerabilities/44230; https://www.exploit-db.com/exploits/6207
CVE: CVE-2008-3508
Published: 2008-08-07
Description: LiteNews 0.1 (aka 01), and possibly 1.2 and earlier, allows remote attackers to bypass authentication and gain administrative access by setting the admin cookie.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/30555; https://exchange.xforce.ibmcloud.com/vulnerabilities/44231; https://www.exploit-db.com/exploits/6206
CVE: CVE-2008-3509
Published: 2008-08-07
Description: LoveCMS 1.6.2 does not require administrative authentication for (1) addblock.php, (2) blocks.php, and (3) themes.php in system/admin/, which allows remote attackers to change the configuration or execute arbitrary PHP code via addition of blocks, and other vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/31389; http://www.securityfocus.com/bid/30562; https://exchange.xforce.ibmcloud.com/vulnerabilities/44226
CVE: CVE-2008-3510
Published: 2008-08-07
Description: Cross-site scripting (XSS) vulnerability in livehelp_js.php in Crafty Syntax Live Help (CSLH) 2.14.6 allows remote attackers to inject arbitrary web script or HTML via the department parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/31340; http://www.craftysyntax.com/help/viewtopic.php?t=3945; http://www.securityfocus.com/bid/30543
CVE: CVE-2008-3511
Published: 2008-08-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in Softbiz Image Gallery (Photo Gallery) allow remote attackers to inject arbitrary web script or HTML via the (1) latest parameter to (a) index.php, (b) images.php, (c) suggest_image.php, and (d) image_desc.php; and the (2) msg parameter to index.php, images.php, and suggest_image.php, and (e) index.php, (f) adminhome.php, (g) config.php, (h) changepassword.php, (i) cleanup.php, (j) browsecats.php, and (k) images.php in admin/. NOTE: the image_desc.php/msg vector is covered by CVE-2006-1660.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/30546; http://www.securityfocus.com/bid/30546/exploit; https://exchange.xforce.ibmcloud.com/vulnerabilities/44433
CVE: CVE-2008-3512
Published: 2008-08-07
Description: SQL injection vulnerability in the Kleinanzeigen module for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the lid parameter in a visit action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.securityfocus.com/archive/1/495166/100/0/threaded; http://www.securityfocus.com/bid/30577; https://exchange.xforce.ibmcloud.com/vulnerabilities/44255
CVE: CVE-2008-3513
Published: 2008-08-07
Description: SQL injection vulnerability in the Book Catalog module 1.0 for PHP-Nuke allows remote attackers to execute arbitrary SQL commands via the catid parameter in a category action to modules.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstorm.linuxsecurity.com/0810-exploits/phpnukebook-sql.txt; http://secunia.com/advisories/32500; http://www.securityfocus.com/archive/1/497929/100/0/threaded
CVE: CVE-2008-3546
Published: 2008-08-07
Description: Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://kerneltrap.org/mailarchive/git/2008/7/16/2529284; http://secunia.com/advisories/31347; http://secunia.com/advisories/31780
CVE: CVE-2008-3548
Published: 2008-08-07
Description: Unspecified vulnerability in the Sun Netra T5220 Server with firmware 7.1.3 allows local users to cause a denial of service (panic) via unknown vectors.
CVSS Score: 4.9 (MEDIUM)
References: http://secunia.com/advisories/31335; http://sunsolve.sun.com/search/document.do?assetkey=1-26-239930-1; http://www.securityfocus.com/bid/30557
CVE: CVE-2008-3549
Published: 2008-08-07
Description: Unspecified vulnerability in the pthread_mutex_reltimedlock_np API in Sun Solaris 10 and OpenSolaris before snv_90 allows local users to cause a denial of service (system hang or panic) via unknown vectors.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-399
References: http://secunia.com/advisories/31348; http://sunsolve.sun.com/search/document.do?assetkey=1-66-239387-1; http://www.securityfocus.com/bid/30561
CVE: CVE-2008-0964
Published: 2008-08-08
Description: Multiple stack-based buffer overflows in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via a crafted SMB packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=734; http://secunia.com/advisories/31386; http://secunia.com/advisories/31535
CVE: CVE-2008-0965
Published: 2008-08-08
Description: Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96, when the -o option is omitted, allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.
CVSS Score: 9.3 (HIGH)
CWE: CWE-134
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=735; http://secunia.com/advisories/31386; http://secunia.com/advisories/31535
CVE: CVE-2008-3272
Published: 2008-08-08
Description: The snd_seq_oss_synth_make_info function in sound/core/seq/oss/seq_oss_synth.c in the sound subsystem in the Linux kernel before 2.6.27-rc2 does not verify that the device number is within the range defined by max_synthdev before returning certain data to the caller, which allows local users to obtain sensitive information.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82e68f7ffec3800425f2391c8c[PII_REDACTED]0442; http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2; http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00000.html
CVE: CVE-2008-1664
Published: 2008-08-08
Description: Unspecified vulnerability in libc on HP HP-UX B.11.23 and B.11.31 allows remote attackers to cause a denial of service via unknown vectors.
CVSS Score: 7.8 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7842&w=2; http://secunia.com/advisories/31400; http://securitytracker.com/id?1020637
CVE: CVE-2008-1945
Published: 2008-08-08
Description: QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
CVSS Score: 2.1 (LOW)
References: http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html; http://secunia.com/advisories/32063; http://secunia.com/advisories/32088
CVE: CVE-2008-2377
Published: 2008-08-08
Description: Use-after-free vulnerability in the _gnutls_handshake_hash_buffers_clear function in lib/gnutls_handshake.c in libgnutls in GnuTLS 2.3.5 through 2.4.0 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via TLS transmission of data that is improperly used when the peer calls gnutls_handshake within a normal session, leading to attempted access to a deallocated libgcrypt handle.
CVSS Score: 7.6 (HIGH)
CWE: CWE-119
References: http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/2947; http://secunia.com/advisories/31505; http://www.gnu.org/software/gnutls/security.html
CVE: CVE-2008-3337
Published: 2008-08-08
Description: PowerDNS Authoritative Server before 2.9.21.1 drops malformed queries, which might make it easier for remote attackers to poison DNS caches of other products running on other servers, a different issue than CVE-2008-1447 and CVE-2008-3217.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-20
References: http://doc.powerdns.com/changelog.html; http://doc.powerdns.com/powerdns-advisory-2008-02.html; http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html
CVE: CVE-2008-3532
Published: 2008-08-08
Description: The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-310
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492434; http://developer.pidgin.im/attachment/ticket/6500/nss-cert-verify.patch; http://developer.pidgin.im/attachment/ticket/6500/nss_add_rev.patch
CVE: CVE-2008-3534
Published: 2008-08-08
Description: The shmem_delete_inode function in mm/shmem.c in the tmpfs implementation in the Linux kernel before 2.6.26.1 allows local users to cause a denial of service (system crash) via a certain sequence of file create, remove, and overwrite operations, as demonstrated by the insserv program, related to allocation of "useless pages" and improper maintenance of the i_blocks count.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-400
References: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.26.y.git%3Ba=commit%3Bh=14fcc23fdc78e9d32372553ccf21758a9bd56fa1; http://lkml.org/lkml/2008/7/26/71; http://secunia.com/advisories/31881
CVE: CVE-2008-3535
Published: 2008-08-08
Description: Off-by-one error in the iov_iter_advance function in mm/filemap.c in the Linux kernel before 2.6.27-rc2 allows local users to cause a denial of service (system crash) via a certain sequence of file I/O operations with readv and writev, as demonstrated by testcases/kernel/fs/ftest/ftest03 from the Linux Test Project.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-193
References: http://mirror.celinuxforum.org/gitstat/commit-detail.php?commit=94ad374a0751f40d25e22e036c37f7263569d24c; http://secunia.com/advisories/31881; http://secunia.com/advisories/32190