deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2008-7270
Published: 2010-12-06
Description: OpenSSL before 0.9.8j, when SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the use of a disabled cipher via vectors involving sniffing network traffic to discover a session identifier, a different vulnerability than CVE-2010-4180.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://cvs.openssl.org/chngview?cn=17489; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0227&w=2; http://secunia.com/advisories/42493
CVE: CVE-2010-4478
Published: 2010-12-06
Description: OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673; http://seb.dbzteam.org/crypto/jpake-session-key-retrieval.pdf; http://www.openbsd.org/cgi-bin/cvsweb/src/usr.bin/ssh/jpake.c#rev1.5
CVE: CVE-2010-4510
Published: 2010-12-06
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2010-4150.  Reason: This candidate is a duplicate of CVE-2010-4150.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2010-4150 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-4246
Published: 2010-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in graph.php in pfSense 1.2.3 and 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via the (1) ifnum or (2) ifname parameter, a different vulnerability than CVE-2008-1182.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2010/11/22/18; http://openwall.com/lists/oss-security/2010/11/24/7; http://seclists.org/fulldisclosure/2010/Nov/43
CVE: CVE-2010-4257
Published: 2010-12-07
Description: SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows remote authenticated users to execute arbitrary SQL commands via the Send Trackbacks field.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-89
References: http://blog.sjinks.pro/wordpress/858-information-disclosure-via-sql-injection-attack/; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605603; http://codex.wordpress.org/Version_3.0.2
CVE: CVE-2010-4259
Published: 2010-12-07
Description: Stack-based buffer overflow in FontForge 20100501 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a long CHARSET_REGISTRY header in a BDF font file.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605537; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052201.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/052219.html
CVE: CVE-2010-4260
Published: 2010-12-07
Description: Multiple unspecified vulnerabilities in pdf.c in libclamav in ClamAV before 0.96.5 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka (1) "bb #2358" and (2) "bb #2396."
CVSS Score: 5.0 (MEDIUM)
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=master; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051905.html
CVE: CVE-2010-4261
Published: 2010-12-07
Description: Off-by-one error in the icon_cb function in pe_icons.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: some of these details are obtained from third party information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=master; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051905.html
CVE: CVE-2010-4330
Published: 2010-12-07
Description: Directory traversal vulnerability in includes/controller.php in Pulse CMS Basic before 1.2.9 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the p parameter to index.php.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-22
References: http://osvdb.org/69622; http://pulsecms.com/release-notes.php; http://secunia.com/advisories/42462
CVE: CVE-2010-4412
Published: 2010-12-07
Description: Multiple cross-site scripting (XSS) vulnerabilities in pfSense 2 beta 4 allow remote attackers to inject arbitrary web script or HTML via (1) the id parameter in an olsrd.xml action to pkg_edit.php, (2) the xml parameter to pkg.php, or the if parameter to (3) status_graph.php or (4) interfaces.php, a different vulnerability than CVE-2008-1182 and CVE-2010-4246.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://openwall.com/lists/oss-security/2010/11/22/18; http://openwall.com/lists/oss-security/2010/11/24/7; http://openwall.com/lists/oss-security/2010/12/06/7
CVE: CVE-2010-4479
Published: 2010-12-07
Description: Unspecified vulnerability in pdf.c in libclamav in ClamAV before 0.96.5 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF document, aka "bb #2380," a different vulnerability than CVE-2010-4260.
CVSS Score: 7.5 (HIGH)
References: http://git.clamav.net/gitweb?p=clamav-devel.git%3Ba=blob_plain%3Bf=ChangeLog%3Bhb=master; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051905.html
CVE: CVE-2010-4482
Published: 2010-12-07
Description: Unspecified vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to bypass the pop-up blocker via unknown vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=17655; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4483
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 does not properly restrict read access to videos derived from CANVAS elements, which allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=55745; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4484
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 does not properly handle HTML5 databases, which allows attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=56237; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4485
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 does not properly restrict the generation of file dialogs, which allows remote attackers to cause a denial of service (reduced usability and possible application crash) via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=58319; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4486
Published: 2010-12-07
Description: Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to history handling.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://code.google.com/p/chromium/issues/detail?id=59554; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4487
Published: 2010-12-07
Description: Incomplete blacklist vulnerability in Google Chrome before 8.0.552.215 on Linux and Mac OS X allows remote attackers to have an unspecified impact via a "dangerous file."
CVSS Score: 7.5 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=59817; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4488
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 does not properly handle HTTP proxy authentication, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-287
References: http://code.google.com/p/chromium/issues/detail?id=61701; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4489
Published: 2010-12-07
Description: libvpx, as used in Google Chrome before 8.0.552.215 and possibly other products, allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted WebM video.  NOTE: this vulnerability exists because of a regression.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-119
References: http://code.google.com/p/chromium/issues/detail?id=61653; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4490
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via malformed video content that triggers an indexing error.
CVSS Score: 9.3 (HIGH)
References: http://code.google.com/p/chromium/issues/detail?id=62127; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4491
Published: 2010-12-07
Description: Google Chrome before 8.0.552.215 does not properly restrict privileged extensions, which allows remote attackers to cause a denial of service (memory corruption) via a crafted extension.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://code.google.com/p/chromium/issues/detail?id=62168; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://secunia.com/advisories/42472
CVE: CVE-2010-4492
Published: 2010-12-07
Description: Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving SVG animations.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=62401; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2010-4493
Published: 2010-12-07
Description: Use-after-free vulnerability in Google Chrome before 8.0.552.215 allows remote attackers to cause a denial of service via vectors related to the handling of mouse dragging events.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=63051; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://lists.opensuse.org/opensuse-security-announce/2011-05/msg00005.html
CVE: CVE-2010-4494
Published: 2010-12-07
Description: Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: http://code.google.com/p/chromium/issues/detail?id=63444; http://googlechromereleases.blogspot.com/2010/12/stable-beta-channel-updates.html; http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
CVE: CVE-2010-4150
Published: 2010-12-07
Description: Double free vulnerability in the imap_do_open function in the IMAP extension (ext/imap/php_imap.c) in PHP 5.2 before 5.2.15 and 5.3 before 5.3.4 allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052836.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052845.html
CVE: CVE-2010-4170
Published: 2010-12-07
Description: The staprun runtime tool in SystemTap 1.3 does not properly clear the environment before executing modprobe, which allows local users to gain privileges by setting the MODPROBE_OPTIONS environment variable to specify a malicious configuration file.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051122.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051127.html
CVE: CVE-2010-4171
Published: 2010-12-07
Description: The staprun runtime tool in SystemTap 1.3 does not verify that a module to unload was previously loaded by SystemTap, which allows local users to cause a denial of service (unloading of arbitrary kernel modules).
CVSS Score: 2.1 (LOW)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051115.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051122.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051127.html
CVE: CVE-2010-4176
Published: 2010-12-07
Description: plymouth-pretrigger.sh in dracut and udev, when running on Fedora 13 and 14, sets weak permissions for the /dev/systty device file, which allows remote authenticated users to read terminal data from tty0 for local users.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-276
References: http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051755.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/051418.html; http://secunia.com/advisories/42342
CVE: CVE-2010-4179
Published: 2010-12-07
Description: The installation documentation for Red Hat Enterprise Messaging, Realtime and Grid (MRG) 1.3 recommends that Condor should be configured so that the MRG Management Console (cumin) can submit jobs for users, which creates a trusted channel with insufficient access control that allows local users with the ability to publish to a broker to run jobs as arbitrary users via Condor QMF plug-ins.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/42406; http://www.redhat.com/support/errata/RHSA-2010-0921.html; http://www.redhat.com/support/errata/RHSA-2010-0922.html
CVE: CVE-2010-4480
Published: 2010-12-08
Description: error.php in PhpMyAdmin 3.3.8.1, and other versions before 3.4.0-beta1, allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted BBcode tag containing "@" characters, as demonstrated using "[a@url@page]".
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42485; http://secunia.com/advisories/42725; http://www.debian.org/security/2010/dsa-2139
CVE: CVE-2010-4500
Published: 2010-12-08
Description: Multiple SQL injection vulnerabilities in contact.php in MRCGIGUY (MCG) FreeTicket 1.0.0, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) name, (2) email, (3) subject, and (4) message parameters in a sendmess action.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/42313; http://www.securityfocus.com/bid/45067; http://secunia.com/advisories/42313
CVE: CVE-2010-2793
Published: 2010-12-08
Description: Race condition in the SPICE (aka spice-activex) plug-in for Internet Explorer in Red Hat Enterprise Virtualization (RHEV) Manager before 2.2.4 allows local users to create a certain named pipe, and consequently gain privileges, via vectors involving knowledge of the name of this named pipe, in conjunction with use of the ImpersonateNamedPipeClient function.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-362
References: http://securitytracker.com/id?1024825; http://www.securityfocus.com/bid/45213; https://bugzilla.redhat.com/show_bug.cgi?id=620355
CVE: CVE-2010-3372
Published: 2010-12-08
Description: Untrusted search path vulnerability in NorduGrid Advanced Resource Connector (ARC) before 0.8.3 allows local users to gain privileges via vectors related to the LD_LIBRARY_PATH environment variable.  NOTE: some of these details are obtained from third party information.
CVSS Score: 6.9 (MEDIUM)
References: http://secunia.com/advisories/42496; http://www.nordugrid.org/arc/releases/0_8_3/release_notes_0_8_3.html; https://exchange.xforce.ibmcloud.com/vulnerabilities/64434
CVE: CVE-2010-4108
Published: 2010-12-08
Description: HP HP-UX B.11.11, B.11.23, and B.11.31 does not properly support threaded processes, which allows remote authenticated users to cause a denial of service via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02586517; http://secunia.com/advisories/42499; http://www.securityfocus.com/bid/45219
CVE: CVE-2010-4109
Published: 2010-12-08
Description: Cross-site scripting (XSS) vulnerability in the Contacts Application in HP Palm webOS before 2.0 allows remote attackers to inject arbitrary web script or HTML via a crafted vCard file.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02639302; http://www.securitytracker.com/id?1024827; http://www.vupen.com/english/advisories/2010/3131
CVE: CVE-2010-3699
Published: 2010-12-08
Description: The backend driver in Xen 3.x allows guest OS users to cause a denial of service via a kernel thread leak, which prevents the device and guest OS from being shut down or create a zombie domain, causes a hang in zenwatch, or prevents unspecified xm commands from working properly, related to (1) netback, (2) blkback, or (3) blktap.
CVSS Score: 2.7 (LOW)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00007.html; http://secunia.com/advisories/42372; http://secunia.com/advisories/42789
CVE: CVE-2010-3860
Published: 2010-12-08
Description: IcedTea 1.7.x before 1.7.6, 1.8.x before 1.8.3, and 1.9.x before 1.9.2, as based on OpenJDK 6, declares multiple sensitive variables as public, which allows remote attackers to obtain sensitive information including (1) user.name, (2) user.home, and (3) java.home system properties, and other sensitive information such as installation directories.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://blog.fuseyism.com/index.php/2010/11/24/icedtea6-176-183-and-192-released/; http://icedtea.classpath.org/hg/release/icedtea6-1.9/rev/9aa0018d8c28; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051711.html
CVE: CVE-2010-3920
Published: 2010-12-08
Description: The Seiko Epson printer driver installers for LP-S9000 before 4.1.11 and LP-S7100 before 4.1.7, or as downloaded from the vendor between May 2010 and 20101125, set weak permissions for the "C:\Program Files" folder, which might allow local users to bypass intended access restrictions and create or modify arbitrary files and directories.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://jvn.jp/en/jp/JVN62736872/index.html; http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-000059.html; http://osvdb.org/69678
CVE: CVE-2010-4012
Published: 2010-12-08
Description: Race condition in Apple iOS 4.0 through 4.1 for iPhone 3G and later allows physically proximate attackers to bypass the passcode lock by making a call from the Emergency Call screen, then quickly pressing the Sleep/Wake button.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-362
References: http://support.apple.com/kb/HT4456; http://support.apple.com/kb/HT4456
CVE: CVE-2010-4501
Published: 2010-12-08
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2010-4334.  Reason: This candidate is a duplicate of CVE-2010-4334.  Notes: All CVE users should reference CVE-2010-4334 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2010-4502
Published: 2010-12-08
Description: Integer overflow in KmxSbx.sys 6.2.0.22 in CA Internet Security Suite Plus 2010 allows local users to cause a denial of service (pool corruption) and execute arbitrary code via crafted arguments to the 0x88000080 IOCTL, which triggers a buffer overflow.
CVSS Score: 7.2 (HIGH)
CWE: CWE-189
References: http://secunia.com/advisories/42267; http://www.exploit-db.com/exploits/15624; http://www.securitytracker.com/id?1024808
CVE: CVE-2010-4503
Published: 2010-12-08
Description: SQL injection vulnerability in indexlight.php in Aigaion 1.3.4 allows remote attackers to execute arbitrary SQL commands via the ID parameter in an export action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96077/aigaion134-sql.txt; http://secunia.com/advisories/42463; http://www.securityfocus.com/bid/45232
CVE: CVE-2010-4504
Published: 2010-12-08
Description: Multiple cross-site scripting (XSS) vulnerabilities in eSyndiCat Directory 2.3 allow remote attackers to inject arbitrary web script or HTML via the title parameter to (1) suggest-category.php and (2) suggest-listing.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/69638; http://osvdb.org/69639; http://packetstormsecurity.org/files/view/96181/esyndicat23-xss.txt
CVE: CVE-2010-4505
Published: 2010-12-08
Description: Multiple SQL injection vulnerabilities in login.php in Injader 2.4.4, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) un and (2) pw parameters.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-89
References: http://secunia.com/advisories/42541; http://www.johnleitch.net/Vulnerabilities/Injader.2.4.4.SQL.Injection/69; http://secunia.com/advisories/42541
CVE: CVE-2009-5021
Published: 2010-12-09
Description: Cobbler before 1.6.1 does not properly determine whether an installation has the default password, which makes it easier for attackers to obtain access by using this password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-255
References: http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz; https://exchange.xforce.ibmcloud.com/vulnerabilities/64734; http://people.fedoraproject.org/~shenson/cobbler/cobbler-2.0.8.tar.gz
CVE: CVE-2010-0530
Published: 2010-12-09
Description: Apple QuickTime before 7.6.9 on Windows sets weak permissions for the Apple Computer directory in the profile of a user account, which allows local users to obtain sensitive information by reading files in this directory.
CVSS Score: 2.1 (LOW)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://support.apple.com/kb/HT4447; http://www.securitytracker.com/id?1024829
CVE: CVE-2010-1508
Published: 2010-12-09
Description: Heap-based buffer overflow in Apple QuickTime before 7.6.9 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted Track Header (aka tkhd) atoms.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2010//Dec/msg00000.html; http://secunia.com/secunia_research/2010-72/; http://support.apple.com/kb/HT4447