deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2106
Published: 2014-02-04
Description: Integer overflow in the pv_import function in util/pv_import.c in Csound 5.16.6, when converting a file, allows remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git%3Ba=commitdiff%3Bh=61d1df45ca9a52bab62892a3c3a13c41e6384505#patch3; http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git%3Ba=commitdiff%3Bh=7d617a9551fb6c552ba16874b71266fcd90f3a6f; http://lists.opensuse.org/opensuse-updates/2012-04/msg00057.html
CVE: CVE-2012-2107
Published: 2014-02-04
Description: Integer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file, which triggers a heap-based buffer overflow.
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git%3Ba=commitdiff%3Bh=61d1df45ca9a52bab62892a3c3a13c41e6384505#patch2; http://lists.opensuse.org/opensuse-updates/2012-04/msg00057.html; http://secunia.com/advisories/48719
CVE: CVE-2012-2108
Published: 2014-02-04
Description: Stack-based buffer overflow in the main function in util/lpci_main.c in Csound before 5.17.2, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://csound.git.sourceforge.net/git/gitweb.cgi?p=csound/csound5.git%3Ba=commitdiff%3Bh=61d1df45ca9a52bab62892a3c3a13c41e6384505; http://lists.opensuse.org/opensuse-updates/2012-04/msg00057.html; http://secunia.com/advisories/48719
CVE: CVE-2014-1458
Published: 2014-02-04
Description: Cross-site scripting (XSS) vulnerability in the web administration interface in FortiGuard FortiWeb 5.0.3 and earlier allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://www.fortiguard.com/advisory/FG-IR-14-001/; https://exchange.xforce.ibmcloud.com/vulnerabilities/90978; http://www.fortiguard.com/advisory/FG-IR-14-001/
CVE: CVE-2012-6493
Published: 2014-02-04
Description: Cross-site request forgery (CSRF) vulnerability in Rapid7 Nexpose Security Console before 5.5.4 allows remote attackers to hijack the authentication of unspecified victims for requests that delete scan data and sites via a request to data/site/delete.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-01/0014.html; http://osvdb.org/88923; http://packetstormsecurity.com/files/119260/Nexpose-Security-Console-Cross-Site-Request-Forgery.html
CVE: CVE-2011-2725
Published: 2014-02-04
Description: Directory traversal vulnerability in Ark 4.7.x and earlier allows remote attackers to delete and force the display of arbitrary files via .. (dot dot) sequences in a zip file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://lists.opensuse.org/opensuse-updates/2012-03/msg00002.html; http://packetstormsecurity.com/files/105610/Ark-2.16-Directory-Traversal.html; http://seclists.org/fulldisclosure/2011/Oct/351
CVE: CVE-2012-0875
Published: 2014-02-04
Description: SystemTap 1.7, 1.6.7, and probably other versions, when unprivileged mode is enabled, allows local users to obtain sensitive information from kernel memory or cause a denial of service (kernel panic and crash) via vectors related to crafted DWARF data, which triggers a read of an invalid pointer.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-264
References: http://lists.opensuse.org/opensuse-updates/2013-03/msg00057.html; http://permalink.gmane.org/gmane.comp.security.oss.general/6987; http://rhn.redhat.com/errata/RHSA-2012-0376.html
CVE: CVE-2014-0497
Published: 2014-02-05
Description: Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-191, CWE-191
References: http://googlechromereleases.blogspot.com/2014/02/stable-channel-update.html; http://helpx.adobe.com/security/products/flash-player/apsb14-04.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00000.html
CVE: CVE-2014-0755
Published: 2014-02-05
Description: Rockwell Automation RSLogix 5000 7 through 20.01, and 21.0, does not properly implement password protection for .ACD files (aka project files), which allows local users to obtain sensitive information or modify data via unspecified vectors.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-522, CWE-255
References: http://osvdb.org/102858; http://www.securityfocus.com/bid/65337; https://exchange.xforce.ibmcloud.com/vulnerabilities/90981
CVE: CVE-2013-1466
Published: 2014-02-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in glFusion before 1.2.2.pl4 allow remote attackers to inject arbitrary web script or HTML via the (1) subject parameter to profiles.php; (2) address1, (3) address2, (4) calendar_type, (5) city, (6) state, (7) title, (8) url, or (9) zipcode parameter to calendar/index.php; (10) title or (11) url parameter to links/index.php; or (12) PATH_INFO to admin/plugins/mediagallery/xppubwiz.php/.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0093.html; http://packetstormsecurity.com/files/120423/glFusion-1.2.2-Cross-Site-Scripting.html; http://secunia.com/advisories/52255
CVE: CVE-2013-1470
Published: 2014-02-05
Description: Cross-site scripting (XSS) vulnerability in calendar/index.php in the Calendar plugin in Geeklog before 1.8.2sr1 and 2.0.0 before 2.0.0rc2 allows remote attackers to inject arbitrary web script or HTML via the calendar_type parameter to submit.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0154.html; http://packetstormsecurity.com/files/120593/Geeklog-1.8.2-Cross-Site-Scripting.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/82326
CVE: CVE-2013-1852
Published: 2014-02-05
Description: SQL injection vulnerability in leaguemanager.php in the LeagueManager plugin before 3.8.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the league_id parameter in the leaguemanager-export page to wp-admin/admin.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://osvdb.org/91442; http://packetstormsecurity.com/files/120817/WordPress-LeagueManager-3.8-SQL-Injection.html; http://wordpress.org/plugins/leaguemanager/changelog
CVE: CVE-2013-1967
Published: 2014-02-05
Description: Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2, as used in ownCloud Server 5.0.x before 5.0.5 and 4.5.x before 4.5.10, allows remote attackers to inject arbitrary web script or HTML via the file parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/about/security/advisories/oC-SA-2013-017; http://seclists.org/oss-sec/2013/q2/111; http://seclists.org/oss-sec/2013/q2/133
CVE: CVE-2013-2691
Published: 2014-02-05
Description: Stack-based buffer overflow in the JetMPG.ax module in jetAudio 8.0.17 allows remote attackers to execute arbitrary code via a crafted MPEG2-TS video file, related to the MPEG2 transport stream.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/92943; http://secunia.com/advisories/52450; http://www.securityfocus.com/bid/59616
CVE: CVE-2013-3639
Published: 2014-02-05
Description: Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id, (2) interface, (3) name, or (4) tabmodule parameter to index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2013-06/0098.html; http://osvdb.org/94598; http://packetstormsecurity.com/files/122174/Xaraya-2.4.0-b1-Cross-Site-Scripting.html
CVE: CVE-2013-4978
Published: 2014-02-05
Description: Stack-based buffer overflow in AloahaPDFViewer 5.0.0.7 and earlier in Aloaha PDF Suite FREE allows remote attackers to execute arbitrary code via a crafted PDF file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://archives.neohapsis.com/archives/bugtraq/2013-08/0179.html; http://secunia.com/advisories/54585; http://www.coresecurity.com/advisories/aloaha-pdf-suite-buffer-overflow-vulnerability
CVE: CVE-2014-1403
Published: 2014-02-05
Description: Cross-site scripting (XSS) vulnerability in name.html in easyXDM before 2.4.19 allows remote attackers to inject arbitrary web script or HTML via the location.hash value.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html; http://osvdb.org/102803; http://seclists.org/fulldisclosure/2014/Feb/5
CVE: CVE-2011-1594
Published: 2014-02-05
Description: A flaw was found in Spacewalk, as used in Red Hat Network Satellite. This open redirect vulnerability allows remote attackers to redirect users to arbitrary web sites by manipulating a URL in the url_bounce parameter. This can enable attackers to conduct phishing attacks, potentially leading to unauthorized information disclosure or credential theft.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-601, CWE-20
References: http://www.redhat.com/support/errata/RHSA-2011-1299.html; https://access.redhat.com/security/cve/CVE-2011-1594; https://bugzilla.redhat.com/show_bug.cgi?id=672167
CVE: CVE-2011-2919
Published: 2014-02-05
Description: Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbitrary web script or HTML via the QueryString to the SystemGroupList.do page.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www.redhat.com/support/errata/RHSA-2011-1299.html; https://bugzilla.redhat.com/show_bug.cgi?id=713478; https://www.redhat.com/archives/spacewalk-announce-list/2011-December/msg00000.html
CVE: CVE-2011-2920
Published: 2014-02-05
Description: A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to inject arbitrary web script or HTML into web pages through various input fields, such as the "Filter by Synopsis" field. This could lead to the execution of malicious code in a user's web browser, potentially compromising user sessions or disclosing sensitive information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.redhat.com/support/errata/RHSA-2011-1299.html; https://access.redhat.com/security/cve/CVE-2011-2920; https://bugzilla.redhat.com/show_bug.cgi?id=681032
CVE: CVE-2011-2927
Published: 2014-02-05
Description: A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackers to inject malicious web scripts or HTML into web pages viewed by other users. The flaw is triggered through vectors related to Search forms, enabling attackers to potentially steal sensitive information or perform actions on behalf of the victim.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.redhat.com/support/errata/RHSA-2011-1299.html; https://access.redhat.com/security/cve/CVE-2011-2927; https://bugzilla.redhat.com/show_bug.cgi?id=730955
CVE: CVE-2011-3344
Published: 2014-02-05
Description: A flaw was found in Spacewalk. A remote attacker can exploit a cross-site scripting (XSS) vulnerability in the Lookup Login/Password form by injecting arbitrary web script or HTML via the URI. This can lead to information disclosure or unauthorized actions within the user's browser session.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: http://www.redhat.com/support/errata/RHSA-2011-1299.html; https://access.redhat.com/security/cve/CVE-2011-3344; https://bugzilla.redhat.com/show_bug.cgi?id=731647
CVE: CVE-2012-0059
Published: 2014-02-05
Description: A flaw was found in Spacewalk-backend. This information disclosure vulnerability occurs when a system registration XML-RPC call fails, causing cleartext user passwords to be included in error messages. Remote administrators can exploit this by reading server logs and emails, leading to the unauthorized disclosure of user passwords.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-209, CWE-310
References: http://rhn.redhat.com/errata/RHSA-2012-0101.html; http://rhn.redhat.com/errata/RHSA-2012-0102.html; https://access.redhat.com/security/cve/CVE-2012-0059
CVE: CVE-2013-1880
Published: 2014-02-05
Description: Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2013-1029.html; http://www.securityfocus.com/bid/65615; https://bugzilla.redhat.com/show_bug.cgi?id=924447
CVE: CVE-2013-4449
Published: 2014-02-05
Description: The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-189
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735; http://rhn.redhat.com/errata/RHSA-2014-0126.html
CVE: CVE-2014-1833
Published: 2014-02-05
Description: Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-22
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=737160; http://osvdb.org/102748; http://www.openwall.com/lists/oss-security/2014/01/31/11
CVE: CVE-2011-3377
Published: 2014-02-05
Description: The web browser plug-in in IcedTea-Web 1.0.x before 1.0.6 and 1.1.x before 1.1.4 allows remote attackers to bypass the Same Origin Policy (SOP) and execute arbitrary script or establish network connections to unintended hosts via an applet whose origin has the same second-level domain, but a different sub-domain than the targeted domain.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://dbhole.wordpress.com/2011/11/08/icedtea-web-1-0-6-and-1-1-4-security-releases-released/; http://lists.opensuse.org/opensuse-updates/2012-03/msg00028.html; http://rhn.redhat.com/errata/RHSA-2011-1441.html
CVE: CVE-2011-4613
Published: 2014-02-05
Description: The X.Org X wrapper (xserver-wrapper.c) in Debian GNU/Linux and Ubuntu Linux does not properly verify the TTY of a user who is starting X, which allows local users to bypass intended access restrictions by associating stdin with a file that is misinterpreted as the console TTY.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652249; http://www.debian.org/security/2011/dsa-2364; http://www.ubuntu.com/usn/USN-1349-1
CVE: CVE-2013-2074
Published: 2014-02-05
Description: kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows attackers to discover credentials via a crafted request that triggers an "internal server error," which includes the username and password in an error message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707776; http://ubuntu.com/usn/usn-1842-1; http://www.openwall.com/lists/oss-security/2013/05/10/4
CVE: CVE-2014-1439
Published: 2014-02-05
Description: The libxml_disable_entity_loader function in runtime/ext/ext_simplexml.cpp in HipHop Virtual Machine for PHP (HHVM) before 2.4.0 and 2.3.x before 2.3.3 does not properly disable a certain libxml handler, which allows remote attackers to conduct XML External Entity (XXE) attacks.
CVSS Score: 5.0 (MEDIUM)
References: http://www.hhvm.com/blog/3287/hhvm-2-4-0; https://exchange.xforce.ibmcloud.com/vulnerabilities/90979; https://github.com/facebook/hhvm/commit/95f96e7287effe2fcdfb9a5338d1a7e4f55b083b
CVE: CVE-2013-4463
Published: 2014-02-06
Description: OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
CVSS Score: 2.1 (LOW)
CWE: CWE-399
References: http://rhn.redhat.com/errata/RHSA-2014-0112.html; http://www.openwall.com/lists/oss-security/2013/10/31/3; http://www.ubuntu.com/usn/USN-2247-1
CVE: CVE-2014-1477
Published: 2014-02-06
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1478
Published: 2014-02-06
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via vectors related to the MPostWriteBarrier class in js/src/jit/MIR.h and stack alignment in js/src/jit/AsmJS.cpp in OdinMonkey, and unknown other vectors.
CVSS Score: 10.0 (HIGH)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00005.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CVE: CVE-2014-1479
Published: 2014-02-06
Description: The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent certain cloning operations, which allows remote attackers to bypass intended restrictions on XUL content via vectors involving XBL content scopes.
CVSS Score: 7.5 (HIGH)
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1480
Published: 2014-02-06
Description: The file-download implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 does not properly restrict the timing of button selections, which allows remote attackers to conduct clickjacking attacks, and trigger unintended launching of a downloaded file, via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-1021
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CVE: CVE-2014-1481
Published: 2014-02-06
Description: Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window objects by leveraging inconsistency in native getter methods across different JavaScript engines.
CVSS Score: 7.5 (HIGH)
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1482
Published: 2014-02-06
Description: RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect write operations) via crafted image data, as demonstrated by Goo Create.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1483
Published: 2014-02-06
Description: Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allow remote attackers to bypass the Same Origin Policy and obtain sensitive information by using an IFRAME element in conjunction with certain timing measurements involving the document.caretPositionFromPoint and document.elementFromPoint functions.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-1021
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CVE: CVE-2014-1484
Published: 2014-02-06
Description: Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2014-03/0153.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html
CVE: CVE-2014-1485
Published: 2014-02-06
Description: The Content Security Policy (CSP) implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 operates on XSLT stylesheets according to style-src directives instead of script-src directives, which might allow remote attackers to execute arbitrary XSLT code by leveraging insufficient style-src restrictions.
CVSS Score: 7.5 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html
CVE: CVE-2014-1486
Published: 2014-02-06
Description: Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving unspecified Content-Type values for image data.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1487
Published: 2014-02-06
Description: The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass the Same Origin Policy and obtain sensitive authentication information via vectors involving error messages.
CVSS Score: 7.5 (HIGH)
CWE: CWE-346
References: http://download.novell.com/Download?buildid=VYQsgaFpQ2k; http://download.novell.com/Download?buildid=Y2fux-JW1Qc; http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127966.html
CVE: CVE-2014-1488
Published: 2014-02-06
Description: The Web workers implementation in Mozilla Firefox before 27.0 and SeaMonkey before 2.24 allows remote attackers to execute arbitrary code via vectors involving termination of a worker process that has performed a cross-thread object-passing operation in conjunction with use of asm.js.
CVSS Score: 10.0 (HIGH)
References: http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00004.html; http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00017.html