deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2005-4884
Published: 2010-01-25
Description: Unspecified vulnerability in the Oracle OLAP component in Oracle Database Server 10.1.0.4 (10g) allows remote authenticated attackers to affect availability via unknown vectors, aka DB02.
CVSS Score: 6.8 (MEDIUM)
References: http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html; http://www.oracle.com/technology/deploy/security/pdf/cpujul2005.html
CVE: CVE-2009-4273
Published: 2010-01-26
Description: stap-server in SystemTap before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in stap command-line arguments in a request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-94
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035201.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-February/035261.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034036.html
CVE: CVE-2010-0003
Published: 2010-01-26
Description: The print_fatal_signal function in kernel/signal.c in the Linux kernel before 2.6.32.4 on the i386 platform, when print-fatal-signals is enabled, allows local users to discover the contents of arbitrary memory locations by jumping to an address and then reading a log file, and might allow local users to cause a denial of service (system slowdown or crash) by jumping to an address.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b45c6e76bc2c72f6426c14bed64fdcbc9bf37cb0; http://lists.fedoraproject.org/pipermail/package-announce/2010-January/034250.html; http://lists.opensuse.org/opensuse-security-announce/2010-02/msg00002.html
CVE: CVE-2010-0006
Published: 2010-01-26
Description: The ipv6_hop_jumbo function in net/ipv6/exthdrs.c in the Linux kernel before 2.6.32.4, when network namespaces are enabled, allows remote attackers to cause a denial of service (NULL pointer dereference) via an invalid IPv6 jumbogram, a related issue to CVE-2007-4567.
CVSS Score: 7.1 (HIGH)
CWE: CWE-476
References: http://bugs.gentoo.org/show_bug.cgi?id=300951; http://cert.fi/en/reports/2010/vulnerability341748.html; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2570a4f5428bcdb[PII_REDACTED]81755741e7fa60
CVE: CVE-2010-0390
Published: 2010-01-26
Description: Unrestricted file upload vulnerability in maxImageUpload/index.php in PHP F1 Max's Image Uploader 1.0, when Apache is not configured to handle the mime-type for files with pjpeg or jpeg extensions, allows remote attackers to execute arbitrary code by uploading a file with a pjpeg or jpeg extension, then accessing it via a direct request to the file in original/.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
References: http://osvdb.org/61808; http://secunia.com/advisories/38018; http://www.exploit-db.com/exploits/11169
CVE: CVE-2010-0391
Published: 2010-01-26
Description: Multiple stack-based buffer overflows in Embarcadero Technologies InterBase SMP 2009 9.0.3.437 allow remote attackers to execute arbitrary code via unknown vectors involving crafted packets.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://osvdb.org/61892; http://secunia.com/advisories/38285; http://www.securityfocus.com/bid/37916
CVE: CVE-2010-0392
Published: 2010-01-26
Description: Stack-based buffer overflow in vpnconf.exe in TheGreenBow IPSec VPN Client 4.51.001, 4.65.003, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy (.tgb) file, related to "phase 2."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/61866; http://secunia.com/advisories/38262; http://www.securityfocus.com/archive/1/509091/100/0/threaded
CVE: CVE-2009-3556
Published: 2010-01-27
Description: A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
CVSS Score: 1.9 (LOW)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00007.html; http://support.avaya.com/css/P8/documents/100073666; http://www.openwall.com/lists/oss-security/2010/01/20/2
CVE: CVE-2009-4272
Published: 2010-01-27
Description: A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long.  NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
CVSS Score: 7.5 (HIGH)
CWE: CWE-667
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=73e42897e8e5619eacb787d2ce69be12f47cfc21; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b6280b47a7a42970d098a3059f4ebe7e55e90d8d; http://support.avaya.com/css/P8/documents/100073666
CVE: CVE-2003-1575
Published: 2010-01-28
Description: VERITAS File System (VxFS) 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissions by accessing a file on a VxFS filesystem.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-113207-05-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200161-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-113207-05-1
CVE: CVE-2003-1576
Published: 2010-01-28
Description: Buffer overflow in pamverifier in Change Manager (CM) 1.0 for Sun Management Center (SunMC) 3.0 on Solaris 8 and 9 on the sparc platform allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-113105-01-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201231-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-113105-01-1
CVE: CVE-2004-2765
Published: 2010-01-28
Description: Cross-site scripting (XSS) vulnerability in Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02, when Internet Explorer is used, allows remote attackers to inject arbitrary web script or HTML via a crafted e-mail message, a different vulnerability than CVE-2005-2022 and CVE-2006-5486.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-56-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201601-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-56-1
CVE: CVE-2004-2766
Published: 2010-01-28
Description: Webmail in Sun ONE Messaging Server 6.1 and iPlanet Messaging Server 5.2 before 5.2hf2.02 allows remote attackers to obtain unspecified "access" to e-mail via a crafted e-mail message, related to a "session hijacking" issue, a different vulnerability than CVE-2005-2022 and CVE-2006-5486.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-200
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-55-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-201180-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-116568-55-1
CVE: CVE-2005-4885
Published: 2010-01-28
Description: Unspecified vulnerability on certain Sun StorEdge 6130 (SE6130) Controller Arrays allows remote attackers to delete data via unknown vectors.
CVSS Score: 7.5 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-66-200971-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-200971-1
CVE: CVE-2009-2693
Published: 2010-01-28
Description: Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-22
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
CVE: CVE-2009-2901
Published: 2010-01-28
Description: The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html; http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
CVE: CVE-2009-2902
Published: 2010-01-28
Description: Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-22
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113; http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html; http://lists.opensuse.org/opensuse-security-announce/2010-04/msg00001.html
CVE: CVE-2009-4183
Published: 2010-01-28
Description: Unspecified vulnerability in HP OpenView Storage Data Protector 6.00 and 6.10 allows local users to obtain unspecified "access" via unknown vectors.
CVSS Score: 4.6 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]9142&w=2; http://secunia.com/advisories/38306; http://www.osvdb.org/61955
CVE: CVE-2010-0139
Published: 2010-01-28
Description: Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.2, and possibly 5 does not properly validate SQL commands, which allows remote attackers to create, modify, or delete data in a database via unspecified vectors, aka Bug ID CSCtc39691.
CVSS Score: 9.0 (HIGH)
CWE: CWE-89
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml; http://www.securityfocus.com/bid/37965; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml
CVE: CVE-2010-0140
Published: 2010-01-28
Description: Multiple unspecified vulnerabilities in the web server in Cisco Unified MeetingPlace 7 before 7.0(2.3) hotfix 5F, 6 before 6.0.639.3, and possibly 5 allow remote attackers to create (1) user or (2) administrator accounts via a crafted URL in a request to the internal interface, aka Bug IDs CSCtc59231 and CSCtd40661.
CVSS Score: 10.0 (HIGH)
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml; http://www.securityfocus.com/bid/37965; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml
CVE: CVE-2010-0141
Published: 2010-01-28
Description: MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote attackers to discover usernames, passwords, and unspecified other data from the user database via a modified authentication sequence to the Audio Server, aka Bug ID CSCsv76935.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-255
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml; http://www.securityfocus.com/bid/37965; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml
CVE: CVE-2010-0142
Published: 2010-01-28
Description: MeetingTime in Cisco Unified MeetingPlace 6 before MR5, and possibly 5, allows remote authenticated users to gain privileges via a modified authentication sequence, aka Bug ID CSCsv66530.
CVSS Score: 8.5 (HIGH)
CWE: CWE-264
References: http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml; http://www.securityfocus.com/bid/37965; http://www.cisco.com/en/US/products/products_security_advisory09186a0080b1490b.shtml
CVE: CVE-2010-0454
Published: 2010-01-28
Description: SQL injection vulnerability in cgi/cgilua.exe/sys/start.htm in Publique! 2.3 allows remote attackers to execute arbitrary SQL commands via the sid parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/61941; http://packetstormsecurity.org/1001-exploits/publique-sql.txt; http://secunia.com/advisories/38302
CVE: CVE-2010-0455
Published: 2010-01-28
Description: Cross-site scripting (XSS) vulnerability in forum/viewtopic.php in PunBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the pid parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.packetstormsecurity.com/1001-exploits/punbb13-xss.txt; http://www.securityfocus.com/bid/37930; https://exchange.xforce.ibmcloud.com/vulnerabilities/55853
CVE: CVE-2010-0456
Published: 2010-01-28
Description: SQL injection vulnerability in the indianpulse Game Server (com_gameserver) component 1.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the grp parameter in a gameserver action to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/11222; http://www.securityfocus.com/bid/37920; http://www.securityfocus.com/bid/37934
CVE: CVE-2010-0457
Published: 2010-01-28
Description: SQL injection vulnerability in home.php in magic-portal 2.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/magicportal-sql.txt; http://www.exploit-db.com/exploits/11235; https://exchange.xforce.ibmcloud.com/vulnerabilities/55849
CVE: CVE-2010-0458
Published: 2010-01-28
Description: Multiple SQL injection vulnerabilities in NetArt Media Blog System 1.5 allow remote attackers to execute arbitrary SQL commands via the (1) cat parameter to index.php and the (2) note parameter to blog.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/0512-exploits/blog12SQL.txt; http://www.exploit-db.com/exploits/11216; http://www.securityfocus.com/bid/37911
CVE: CVE-2010-0459
Published: 2010-01-28
Description: SQL injection vulnerability in the Mochigames (com_mochigames) component 0.51 and possibly other versions for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/joomlamochigames-sql.txt; http://www.exploit-db.com/exploits/11243; http://www.securityfocus.com/bid/37931
CVE: CVE-2010-0460
Published: 2010-01-28
Description: Multiple cross-site scripting (XSS) vulnerabilities in staff/index.php in Kayako SupportSuite 3.60.04 and earlier allow remote authenticated users to inject arbitrary web script or HTML via the (1) subject parameter and (2) contents parameter (aka body) in an insertquestion action.  NOTE: some of these details are obtained from third party information.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://osvdb.org/61928; http://packetstormsecurity.org/1001-advisories/kayako-xss.txt; http://secunia.com/advisories/38322
CVE: CVE-2010-0461
Published: 2010-01-28
Description: SQL injection vulnerability in the casino (com_casino) component 1.0 for Joomla! allows remote attackers to execute arbitrary SQL commands via the id parameter in a (1) category or (2) player action to index.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://packetstormsecurity.org/1001-exploits/joomlacasino1-sql.txt; http://www.exploit-db.com/exploits/11237; http://www.securityfocus.com/bid/37938
CVE: CVE-2010-0462
Published: 2010-01-28
Description: Heap-based buffer overflow in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 allows remote authenticated users to have an unspecified impact via a SELECT statement that has a long column name generated with the REPEAT function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT; http://intevydis.blogspot.com/2010/01/ibm-db2-97-heap-overflow.html; http://securitytracker.com/id?1023509
CVE: CVE-2009-2624
Published: 2010-01-29
Description: The huft_build function in inflate.c in gzip before 1.3.13 creates a hufts (aka huffman) table that is too small, which allows remote attackers to cause a denial of service (application crash or infinite loop) or possibly execute arbitrary code via a crafted archive.  NOTE: this issue is caused by a CVE-2006-4334 regression.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://article.gmane.org/gmane.comp.gnu.gzip.bugs/258; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=507263; http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=39a362ae9d9b007473381dba5032f4dfc1744cf2
CVE: CVE-2009-4629
Published: 2010-01-29
Description: Mozilla Necko, as used in Thunderbird 3.0.1, SeaMonkey, and other applications, performs DNS prefetching even when the app type is APP_TYPE_MAIL or APP_TYPE_EDITOR, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests, as demonstrated by DNS requests triggered by reading text/plain e-mail messages in Thunderbird.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=492196; https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail; https://bugzilla.mozilla.org/show_bug.cgi?id=492196
CVE: CVE-2009-4630
Published: 2010-01-29
Description: Mozilla Necko, as used in Firefox, SeaMonkey, and other applications, performs DNS prefetching of domain names contained in links within local HTML documents, which makes it easier for remote attackers to determine the network location of the application's user by logging DNS requests.  NOTE: the vendor disputes the significance of this issue, stating "I don't think we necessarily need to worry about that case."
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: https://bugzilla.mozilla.org/show_bug.cgi?id=453403; https://bugzilla.mozilla.org/show_bug.cgi?id=492196; https://bugzilla.mozilla.org/show_bug.cgi?id=453403
CVE: CVE-2010-0001
Published: 2010-01-29
Description: Integer underflow in the unlzw function in unlzw.c in gzip before 1.4 on 64-bit platforms, as used in ncompress and probably others, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted archive that uses LZW compression, leading to an array index error.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://git.savannah.gnu.org/cgit/gzip.git/commit/?id=a3db5806d012082b9e25cc36d09f19cd736a468f; http://itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02286083; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
CVE: CVE-2010-0004
Published: 2010-01-29
Description: ViewVC before 1.1.3 composes the root listing view without using the authorizer for each root, which might allow remote attackers to discover private root names by reading this view.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://viewvc.tigris.org/source/browse/%2Acheckout%2A/viewvc/trunk/docs/release-notes/1.1.0.html?revision=2222; http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD
CVE: CVE-2010-0005
Published: 2010-01-29
Description: query.py in the query interface in ViewVC before 1.1.3 does not reject configurations that specify an unsupported authorizer for a root, which might allow remote attackers to bypass intended access restrictions via a query.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00009.html; http://viewvc.tigris.org/source/browse/viewvc/trunk/CHANGES?r1=2242&r2=2313&pathrev=HEAD; http://viewvc.tigris.org/source/browse/viewvc?view=rev&revision=2300
CVE: CVE-2010-0463
Published: 2010-01-29
Description: Horde IMP 4.3.6 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.horde.org/ticket/8836; https://exchange.xforce.ibmcloud.com/vulnerabilities/56052; https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
CVE: CVE-2010-0464
Published: 2010-01-29
Description: Roundcube 0.3.1 and earlier does not request that the web browser avoid DNS prefetching of domain names contained in e-mail messages, which makes it easier for remote attackers to determine the network location of the webmail user by logging DNS requests.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://trac.roundcube.net/ticket/1486449; http://www.mandriva.com/security/advisories?name=MDVSA-2010:048; https://secure.grepular.com/DNS_Prefetch_Exposure_on_Thunderbird_and_Webmail
CVE: CVE-2009-3035
Published: 2010-02-02
Description: The web console in Symantec Altiris Notification Server 6.0.x before 6.0 SP3 R12 uses a hardcoded key that can decrypt SQL Server credentials and certain discovery credentials, and stores this key on the Notification Server machine, which allows local users to obtain sensitive information and possibly execute arbitrary code by decrypting and using these credentials.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://osvdb.org/62010; http://secunia.com/advisories/38356; http://www.securityfocus.com/bid/37953
CVE: CVE-2009-4013
Published: 2010-02-02
Description: Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00; http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d; http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog
CVE: CVE-2009-4014
Published: 2010-02-02
Description: Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.
CVSS Score: 7.5 (HIGH)
CWE: CWE-134
References: http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00; http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d; http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog
CVE: CVE-2009-4015
Published: 2010-02-02
Description: Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00; http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d; http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog