deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-0417
Published: 2013-01-17
Description: Unspecified vulnerability in the Sun Storage Common Array Manager (CAM) component in Oracle Sun Products Suite 6.9.0 allows remote attackers to affect confidentiality, related to Fault Management System (FMS).
CVSS Score: 5.0 (MEDIUM)
References: http://www.mandriva.com/security/advisories?name=MDVSA-2013:150; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
CVE: CVE-2013-0418
Published: 2013-01-17
Description: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393.  NOTE: the previous information was obtained from the January 2013 CPU.  Oracle has not commented on claims from an independent researcher that this is a heap-based buffer overflow in the Paradox database stream filter (vspdx.dll) that can be triggered using a table header with a crafted "number of fields" value.
CVSS Score: 6.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0073.html; http://www-01.ibm.com/support/docview.wss?uid=swg21660640; http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
CVE: CVE-2013-0420
Published: 2013-01-17
Description: Unspecified vulnerability in the VirtualBox component in Oracle Virtualization 4.0, 4.1, and 4.2 allows local users to affect integrity and availability via unknown vectors related to Core.  NOTE: The previous information was obtained from the January 2013 Oracle CPU. Oracle has not commented on claims from another vendor that this issue is related to an incorrect comparison in the vga_draw_text function in Devices/Graphics/DevVGA.cpp, which can cause VirtualBox to "draw more lines than necessary."
CVSS Score: 2.4 (LOW)
References: http://lists.opensuse.org/opensuse-updates/2013-02/msg00000.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:150; http://www.oracle.com/technetwork/topics/security/cpujan2[PII_REDACTED].html
CVE: CVE-2012-5419
Published: 2013-01-17
Description: Cisco Adaptive Security Appliance (ASA) software 8.7.1 and 8.7.1.1 for the Cisco ASA 1000V Cloud Firewall allows remote attackers to cause a denial of service (device reload) via a malformed H.225 H.323 IPv4 packet, aka Bug IDs CSCuc42812 and CSCuc88741.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130116-asa1000v; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130116-asa1000v
CVE: CVE-2012-5444
Published: 2013-01-17
Description: Cisco TelePresence Video Communication Server (VCS) X7.0.3 does not properly process certain search rules, which allows remote attackers to create conferences via an unspecified Conductor request, aka Bug ID CSCub67989.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5444; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5444
CVE: CVE-2012-6392
Published: 2013-01-17
Description: Cisco Prime LAN Management Solution (LMS) 4.1 through 4.2.2 on Linux does not properly validate authentication and authorization requests in TCP sessions, which allows remote attackers to execute arbitrary commands via a crafted session, aka Bug ID CSCuc79779.
CVSS Score: 10.0 (HIGH)
CWE: CWE-20
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130109-lms
CVE: CVE-2012-6397
Published: 2013-01-17
Description: Cross-site scripting (XSS) vulnerability in Cisco WebEx Social (formerly Cisco Quad) allows remote attackers to inject arbitrary web script or HTML via a crafted RSS service link, aka Bug ID CSCub61977.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6397; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6397
CVE: CVE-2013-1109
Published: 2013-01-17
Description: Cross-site request forgery (CSRF) vulnerability in testingLibraryAction.do in the Training Center testing library in Cisco WebEx Training Center allows remote attackers to hijack the authentication of arbitrary users for requests that delete tests, aka Bug ID CSCzu81067.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1109; http://www.securitytracker.com/id/1028016; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1109
CVE: CVE-2012-4689
Published: 2013-01-17
Description: Integer overflow in CimWebServer.exe in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY 4.01 through 8.0, and Proficy Process Systems with CIMPLICITY, allows remote attackers to cause a denial of service (daemon crash) via a malformed HTTP request.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15153; http://www.us-cert.gov/control_systems/pdf/ICSA-12-341-01.pdf; http://support.ge-ip.com/support/index?page=kbchannel&id=S:KB15153
CVE: CVE-2012-5972
Published: 2013-01-17
Description: Directory traversal vulnerability in the web server in SpecView 2.5 build 853 and earlier allows remote attackers to read arbitrary files via a ... (dot dot dot) in a URI.
CVSS Score: 2.6 (LOW)
CWE: CWE-23, CWE-22
References: http://aluigi.altervista.org/adv/specview_1-adv.txt; https://www.cisa.gov/news-events/ics-advisories/icsa-13-011-02; http://aluigi.altervista.org/adv/specview_1-adv.txt
CVE: CVE-2012-5429
Published: 2013-01-17
Description: The VPN driver in Cisco VPN Client on Windows does not properly interact with the kernel, which allows local users to cause a denial of service (kernel fault and system crash) via a crafted application, aka Bug ID CSCuc81669.
CVSS Score: 4.6 (MEDIUM)
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5429; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5429
CVE: CVE-2013-0172
Published: 2013-01-17
Description: Samba 4.0.x before 4.0.1, in certain Active Directory domain-controller configurations, does not properly interpret Access Control Entries that are based on an objectClass, which allows remote authenticated users to bypass intended restrictions on modifying LDAP directory objects by leveraging (1) objectClass access by a user, (2) objectClass access by a group, or (3) write access to an attribute.
CVSS Score: 3.5 (LOW)
CWE: CWE-264
References: http://www.samba.org/samba/security/CVE-2013-0172; http://www.samba.org/samba/security/CVE-2013-0172
CVE: CVE-2012-3310
Published: 2013-01-17
Description: IBM Tivoli Federated Identity Manager (TFIM) before 6.1.1.14, 6.2.0 before 6.2.0.12, and 6.2.1 before 6.2.1.4 allows context-dependent attackers to discover (1) a cleartext LDAP Bind Password, (2) keystore passwords, (3) a cleartext Basic Authentication password from a client, or (4) a cleartext user password by leveraging a logging configuration with a log trace setting of all.
CVSS Score: 3.5 (LOW)
CWE: CWE-255
References: http://www-01.ibm.com/support/docview.wss?uid=swg1IV26822; http://www-01.ibm.com/support/docview.wss?uid=swg1IV26823; http://www-01.ibm.com/support/docview.wss?uid=swg1IV26824
CVE: CVE-2012-4607
Published: 2013-01-17
Description: Buffer overflow in nsrindexd in EMC NetWorker 7.5.x and 7.6.x before 7.6.5, and 8.x before 8.0.0.6, allows remote attackers to execute arbitrary code via crafted SunRPC data.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0029.html; http://archives.neohapsis.com/archives/bugtraq/2013-01/0029.html
CVE: CVE-2012-2124
Published: 2013-01-18
Description: functions/imap_general.php in SquirrelMail, as used in Red Hat Enterprise Linux (RHEL) 4 and 5, does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preference files.  NOTE: this issue exists because of an incorrect fix for CVE-2010-2813.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2013-0126.html; http://secunia.com/advisories/51730; http://www.openwall.com/lists/oss-security/2012/04/20/22
CVE: CVE-2012-5531
Published: 2013-01-18
Description: Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss Enterprise Portal Platform 5.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-0141.html; http://secunia.com/advisories/51775; http://rhn.redhat.com/errata/RHSA-2013-0141.html
CVE: CVE-2012-5656
Published: 2013-01-18
Description: The rasterization process in Inkscape before 0.48.4 allows local users to read arbitrary files via an external entity in a SVG file, aka an XML external entity (XXE) injection attack.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-611
References: http://bazaar.launchpad.net/~inkscape.dev/inkscape/trunk/revision/11931; http://lists.fedoraproject.org/pipermail/package-announce/2012-December/095024.html; http://lists.fedoraproject.org/pipermail/package-announce/2013-January/095380.html
CVE: CVE-2012-5875
Published: 2013-01-18
Description: Firefly Media Server 1.0.0.1359 allows remote attackers to cause a denial of service (NULL pointer dereference) via a (1) crafted Connection HTTP header; a return carriage control character in the (2) Accept Language header, (3) User-agent header, (4) Host header, or (5) protocol version; or a (6) crafted HTTP protocol version.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2012-12/0115.html; http://www.exploit-db.com/exploits/23574; http://www.securitytracker.com/id?1027917
CVE: CVE-2012-6088
Published: 2013-01-18
Description: The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-255
References: http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=3d74c43; http://rpm.org/wiki/Releases/4.10.2; http://secunia.com/advisories/51706
CVE: CVE-2012-5717
Published: 2013-01-18
Description: Cisco Adaptive Security Appliances (ASA) devices with firmware 8.x through 8.4(1) do not properly manage SSH sessions, which allows remote authenticated users to cause a denial of service (device crash) by establishing multiple sessions, aka Bug ID CSCtc59462.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5717; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-5717
CVE: CVE-2012-6359
Published: 2013-01-18
Description: IBM Tivoli Federated Identity Manager (TFIM) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 and Tivoli Federated Identity Manager Business Gateway (TFIMBG) 6.2.0 before 6.2.0.11, 6.2.1 before 6.2.1.3, and 6.2.2 before 6.2.2.2 do not check whether an OpenID attribute is signed in the (1) SREG (aka simple registration extension) and (2) AX (aka attribute exchange extension) cases, which allows man-in-the-middle attackers to spoof OpenID provider data by inserting unsigned attributes.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://secunia.com/advisories/51212; http://www-01.ibm.com/support/docview.wss?uid=swg1IV23451; http://www-01.ibm.com/support/docview.wss?uid=swg1IV23452
CVE: CVE-2012-6360
Published: 2013-01-18
Description: Cross-site scripting (XSS) vulnerability in IBM Intelligent Operations Center 1.5.0 allows remote attackers to inject arbitrary web script or HTML via event data fields.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg1PO00211; http://www-01.ibm.com/support/docview.wss?uid=swg21622222; https://exchange.xforce.ibmcloud.com/vulnerabilities/80942
CVE: CVE-2012-6395
Published: 2013-01-18
Description: Cisco Adaptive Security Appliances (ASA) devices with firmware 8.4 do not properly validate unspecified input related to UNC share pathnames, which allows remote authenticated users to cause a denial of service (device crash) via unknown vectors, aka Bug ID CSCuc65775.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-20
References: http://secunia.com/advisories/51955; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6395; http://www.securitytracker.com/id/1028009
CVE: CVE-2009-4738
Published: 2013-01-18
Description: Unspecified vulnerability in JustSystems Corporation ATOK 2006 through 2009 and ATOK flat-rate service, and Just Smile 4 with the ATOK Smile module, allows physically proximate users to bypass the screen lock and execute commands with system privileges via unknown vectors related to "launching external applications."
CVSS Score: 7.2 (HIGH)
References: http://jvn.jp/en/jp/JVN57040664/index.html; http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000057.html; http://secunia.com/advisories/36560
CVE: CVE-2009-5134
Published: 2013-01-18
Description: Buffer overflow in the "create torrent dialog" functionality in uTorrent 1.8.3 build 15772, and possibly other versions before 1.8.3 (Build 16010), allows user-assisted remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a text file containing a large string.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://forum.utorrent.com/viewtopic.php?id=58768; http://www.exploit-db.com/exploits/9539; https://exchange.xforce.ibmcloud.com/vulnerabilities/52907
CVE: CVE-2012-5184
Published: 2013-01-19
Description: Cross-site scripting (XSS) vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://jvn.jp/en/jp/JVN91881278/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000001; https://itunes.apple.com/us/app/documents-pro/id374142847
CVE: CVE-2012-5185
Published: 2013-01-19
Description: Directory traversal vulnerability in the Olive Toast Documents Pro File Viewer (formerly Files HD) app before 1.11.1 for iOS allows remote attackers to read or delete files by leveraging guest access.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://jvn.jp/en/jp/JVN52197991/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2013-000002; https://itunes.apple.com/us/app/documents-pro/id374142847
CVE: CVE-2012-6396
Published: 2013-01-19
Description: Cisco NX-OS on Nexus 7000 series switches does not properly handle certain line-card replacements, which might allow remote authenticated users to cause a denial of service (memory consumption) via a crafted configuration that references interfaces that do not exist on the new card, aka Bug ID CSCud44300.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-399
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6396; http://www.securitytracker.com/id/1028018; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2012-6396
CVE: CVE-2012-6113
Published: 2013-01-19
Description: The openssl_encrypt function in ext/openssl/openssl.c in PHP 5.3.9 through 5.3.13 does not initialize a certain variable, which allows remote attackers to obtain sensitive information from process memory by providing zero bytes of input data.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=270a406ac94b5fc5cc9ef59fc61e3b4b95648a3e; http://openwall.com/lists/oss-security/2013/01/18/6; http://www.ubuntu.com/usn/USN-1702-1
CVE: CVE-2013-0655
Published: 2013-01-21
Description: The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin, which allows man-in-the-middle attackers to spoof updates, and consequently execute arbitrary code, by modifying the data stream on TCP port 80.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://www.schneider-electric.com/download/ww/en/details/29960967-SE-Software-Update-Utility-Vulnerability-Disclosure/?reference=SEVD-2013-009-01; http://www.us-cert.gov/control_systems/pdf/ICSA-13-016-01.pdf; http://www2.schneider-electric.com/corporate/en/support/cybersecurity/viewer-news.page?c_filepath=/templatedata/Content/News/data/en/local/cybersecurity/general_information/2013/01/20130109_advisory_of_vulnerability_affecting_schneider_electric_s_software_upda.xml
CVE: CVE-2013-0657
Published: 2013-01-21
Description: Stack-based buffer overflow in Schneider Electric Interactive Graphical SCADA System (IGSS) 10 and earlier allows remote attackers to execute arbitrary code by sending TCP port-12397 data that does not comply with a protocol.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://igss.schneider-electric.com/igss/igssupdates/v100/progupdatesv100.zip; http://igss.schneider-electric.com/igss/igssupdates/v90/progupdatesv90.zip; http://www.us-cert.gov/control_systems/pdf/ICSA-13-018-01.pdf
CVE: CVE-2012-2291
Published: 2013-01-21
Description: EMC Avamar Client 4.x, 5.x, and 6.x on HP-UX and Mac OS X, and the EMC Avamar plugin 4.x, 5.x, and 6.x for Oracle, uses world-writable permissions for cache directories, which allows local users to gain privileges via an unspecified symlink attack.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html; http://archives.neohapsis.com/archives/bugtraq/2013-01/0086.html
CVE: CVE-2012-6068
Published: 2013-01-21
Description: The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284, CWE-264
References: http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html; http://www.digitalbond.com/tools/basecamp/3s-codesys/; https://us.codesys.com/ecosystem/security/
CVE: CVE-2012-6069
Published: 2013-01-21
Description: The CoDeSys Runtime Toolkit’s file transfer functionality does not 
perform input validation, which allows an attacker to access files and 
directories outside the intended scope. This may allow an attacker to 
upload and download any file on the device. This could allow the 
attacker to affect the availability, integrity, and confidentiality of 
the device.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-23, CWE-22
References: http://www.codesys.com/news-events/press-releases/detail/article/sicherheitsluecke-in-codesys-v23-laufzeitsystem.html; http://www.digitalbond.com/tools/basecamp/3s-codesys/; https://us.codesys.com/ecosystem/security/
CVE: CVE-2013-0656
Published: 2013-01-21
Description: Buffer overflow in a third-party ActiveX component in Siemens SIMATIC RF-MANAGER 2008, and RF-MANAGER Basic 3.0 and earlier, allows remote attackers to execute arbitrary code via a crafted web site.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf; http://www.us-cert.gov/control_systems/pdf/ICSA-13-014-01.pdf; http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-099741.pdf
CVE: CVE-2013-0928
Published: 2013-01-21
Description: The NetWorker command processor in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary commands via a DCP "run command" operation.
CVSS Score: 9.3 (HIGH)
CWE: CWE-78
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0078.html; http://www.exploit-db.com/exploits/34756; http://www.securityfocus.com/bid/57472
CVE: CVE-2013-0929
Published: 2013-01-21
Description: Format string vulnerability in the _vsnsprintf function in rrobotd.exe in the Device Manager in EMC AlphaStor 4.0 before build 800 allows remote attackers to execute arbitrary code via format string specifiers in a command.
CVSS Score: 7.6 (HIGH)
CWE: CWE-134
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0078.html; http://www.securityfocus.com/bid/57472; http://archives.neohapsis.com/archives/bugtraq/2013-01/0078.html
CVE: CVE-2013-1108
Published: 2013-01-21
Description: Cisco WebEx Training Center allows remote authenticated users to remove hands-on lab-session reservations via a crafted URL, aka Bug ID CSCzu81064.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1108; http://www.securitytracker.com/id/1028014; http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1108
CVE: CVE-2013-1110
Published: 2013-01-21
Description: Cisco WebEx Training Center allow remote authenticated users to bypass intended privilege restrictions and (1) enable or (2) disable training-center recordings via a crafted URL, aka Bug ID CSCzu81065.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-264
References: http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-1110; http://www.securityfocus.com/bid/57488; http://www.securitytracker.com/id/1028013
CVE: CVE-2012-6502
Published: 2013-01-22
Description: Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-value pair from a local file via a \\127.0.0.1\C$\ sequence.
CVSS Score: 2.6 (LOW)
CWE: CWE-200
References: http://www.nsfocus.com/en/2012/advisories_1228/119.html; http://www.nsfocus.com/en/2012/advisories_1228/119.html
CVE: CVE-2012-2119
Published: 2013-01-22
Description: Buffer overflow in the macvtap device driver in the Linux kernel before 3.4.5, when running in certain configurations, allows privileged KVM guest users to cause a denial of service (crash) via a long descriptor with a long vector length.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-119
References: http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=814278; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b92946e2919134ebe2a4083e[PII_REDACTED]ea2a73; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html
CVE: CVE-2012-2137
Published: 2013-01-22
Description: Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commitdiff%3Bh=f2ebd422f71cda9c791f76f85d2ca102ae34a1ed; http://lists.opensuse.org/opensuse-security-announce/2013-06/msg00005.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2
CVE: CVE-2012-2372
Published: 2013-01-22
Description: The rds_ib_xmit function in net/rds/ib_send.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel 3.7.4 and earlier allows local users to cause a denial of service (BUG_ON and kernel panic) by establishing an RDS connection with the source IP address equal to the IPoIB interface's own IP address, as demonstrated by rds-ping.
CVSS Score: 4.4 (MEDIUM)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6211&w=2; http://rhn.redhat.com/errata/RHSA-2012-0743.html; http://rhn.redhat.com/errata/RHSA-2012-1540.html