deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2011-0186
Published: 2011-03-23
Description: QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted JPEG2000 image.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-787
References: http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581
CVE: CVE-2011-0187
Published: 2011-03-23
Description: The plug-in in QuickTime in Apple Mac OS X before 10.6.7 allows remote attackers to bypass the Same Origin Policy and obtain potentially sensitive video data via vectors involving a cross-site redirect.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html; http://lists.apple.com/archives/security-announce/2011//Aug/msg00000.html
CVE: CVE-2011-0188
Published: 2011-03-23
Description: The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
CVE: CVE-2011-0189
Published: 2011-03-23
Description: The default configuration of Terminal in Apple Mac OS X 10.6 before 10.6.7 uses SSH protocol version 1 within the New Remote Connection dialog, which might make it easier for man-in-the-middle attackers to spoof SSH servers by leveraging protocol vulnerabilities.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-16
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0190
Published: 2011-03-23
Description: Install Helper in Installer in Apple Mac OS X before 10.6.7 does not properly process an unspecified URL, which might allow remote attackers to track user logins by logging network traffic from an agent that was intended to send network traffic to an Apple server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0193
Published: 2011-03-23
Description: Multiple buffer overflows in Image RAW in Apple Mac OS X before 10.6.7 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted Canon RAW image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2011-0194
Published: 2011-03-23
Description: Integer overflow in ImageIO in Apple Mac OS X 10.6 before 10.6.7 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html; http://support.apple.com/kb/HT4581; http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
CVE: CVE-2010-4769
Published: 2011-03-23
Description: Directory traversal vulnerability in the Jimtawl (com_jimtawl) component 1.0.2 Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. (dot dot) in the task parameter to index.php.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: http://secunia.com/advisories/42324; http://www.exploit-db.com/exploits/15585; http://www.securityfocus.com/bid/44992
CVE: CVE-2010-4770
Published: 2011-03-23
Description: SQL injection vulnerability in index.php in CommodityRentals DVD Rentals Script allows remote attackers to execute arbitrary SQL commands via the cat_id parameter in a catalog action.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/96010/dvdrental-sql.txt; http://secunia.com/advisories/42330; http://securityreason.com/securityalert/8159
CVE: CVE-2010-4771
Published: 2011-03-23
Description: SQL injection vulnerability to viewforum.php in S-CMS 2.5 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://secunia.com/advisories/42323; http://www.exploit-db.com/exploits/15588; http://www.securityfocus.com/bid/44994
CVE: CVE-2010-4772
Published: 2011-03-23
Description: Cross-site scripting (XSS) vulnerability in blocks/lang.php in S-CMS 2.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter to viewforum.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/42323; http://www.exploit-db.com/exploits/15588; http://www.securityfocus.com/bid/44994
CVE: CVE-2010-4773
Published: 2011-03-23
Description: Unspecified vulnerability in Hitachi EUR Form Client before 05-10 -/D 2010.11.15 and 05-10-CA (* 2) 2010.11.15; Hitachi EUR Form Service before 05-10 -/D 2010.11.15; and uCosminexus EUR Form Service before 07-60 -/D 2010.11.15 on Windows, before 05-10 -/D 2010.11.15 and 07-50 -/D 2010.11.15 on Linux, and before 07-50 -/C 2010.11.15 on AIX; allows remote attackers to execute arbitrary code via unknown attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://osvdb.org/69363; http://secunia.com/advisories/42207; http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/HS10-027/index.html
CVE: CVE-2010-4774
Published: 2011-03-23
Description: SQL injection vulnerability in pdf.php in AuraCMS 1.62 allows remote attackers to execute arbitrary SQL commands via the id parameter, a different vector than CVE-2007-4804 and CVE-2007-4171.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://www.exploit-db.com/exploits/15594; http://www.exploit-db.com/exploits/15594
CVE: CVE-2010-4775
Published: 2011-03-23
Description: The Relevant Content module 5.x before 5.x-1.4 and 6.x before 6.x-1.5 for Drupal does not properly implement node access logic, which allows remote attackers to discover restricted node titles and relationships.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-20
References: http://drupal.org/node/974668; http://drupal.org/node/974672; http://drupal.org/node/975094
CVE: CVE-2010-4776
Published: 2011-03-23
Description: SQL injection vulnerability in takefreestart.php in PreProjects Pre Online Tests Generator Pro allows remote attackers to execute arbitrary SQL commands via the tid2 parameter.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://packetstormsecurity.org/files/view/95817/potgp-sql.txt; http://securityreason.com/securityalert/8158; http://www.exploit-db.com/exploits/15526
CVE: CVE-2011-0890
Published: 2011-03-25
Description: HP Discovery & Dependency Mapping Inventory (DDMI) 7.50, 7.51, 7.60, 7.61, 7.70, and 9.30 launches the Windows SNMP service with its default configuration, which allows remote attackers to obtain potentially sensitive information or have unspecified other impact by leveraging the public read community.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6878&w=2; http://securityreason.com/securityalert/8163; http://securitytracker.com/id?1025239
CVE: CVE-2011-1291
Published: 2011-03-25
Description: Google Chrome before 10.0.648.204 does not properly handle base strings, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors, related to a "buffer error."
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: http://code.google.com/p/chromium/issues/detail?id=72517; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://secunia.com/advisories/43859
CVE: CVE-2011-1292
Published: 2011-03-25
Description: Use-after-free vulnerability in the frame-loader implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=73216; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://secunia.com/advisories/43859
CVE: CVE-2011-1293
Published: 2011-03-25
Description: Use-after-free vulnerability in the HTMLCollection implementation in Google Chrome before 10.0.648.204 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-416
References: http://code.google.com/p/chromium/issues/detail?id=73595; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1294
Published: 2011-03-25
Description: Google Chrome before 10.0.648.204 does not properly handle Cascading Style Sheets (CSS) token sequences, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=74562; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://secunia.com/advisories/43859
CVE: CVE-2011-1295
Published: 2011-03-25
Description: WebKit, as used in Google Chrome before 10.0.648.204 and Apple Safari before 5.0.6, does not properly handle node parentage, which allows remote attackers to cause a denial of service (DOM tree corruption), conduct cross-site scripting (XSS) attacks, or possibly have unspecified other impact via unknown vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=74991; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
CVE: CVE-2011-1296
Published: 2011-03-25
Description: Google Chrome before 10.0.648.204 does not properly handle SVG text, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=75170; http://googlechromereleases.blogspot.com/2011/03/stable-channel-update.html; http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.html
CVE: CVE-2011-1400
Published: 2011-03-25
Description: The default configuration of the shell_escape_commands directive in conf/texmf.d/95NonPath.cnf in the tex-common package before 2.08.1 in Debian GNU/Linux squeeze, Ubuntu 10.10 and 10.04 LTS, and possibly other operating systems lists certain programs, which might allow remote attackers to execute arbitrary code via a crafted TeX document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-16
References: http://secunia.com/advisories/43816; http://secunia.com/advisories/43973; http://svn.debian.org/wsvn/debian-tex/?op=comp&compare%5B%5D=%2Ftex-common%2Ftrunk%404781&compare%5B%5D=%2Ftex-common%2Ftrunk%404812
CVE: CVE-2011-1519
Published: 2011-03-25
Description: The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client, which allows remote attackers to bypass authentication, and consequently execute arbitrary code, by placing this pathname in the COOKIEFILE field.  NOTE: this might overlap CVE-2011-0920.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/43860; http://securityreason.com/securityalert/8164; http://securitytracker.com/id?1025241
CVE: CVE-2011-1520
Published: 2011-03-25
Description: The default configuration of the server console in IBM Lotus Domino does not require a password (aka Server_Console_Password), which allows physically proximate attackers to perform administrative changes or obtain sensitive information via a (1) Load, (2) Tell, or (3) Set Configuration command.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://publib.boulder.ibm.com/infocenter/domhelp/v8r0/index.jsp?topic=/com.ibm.help.domino.admin.doc/DOC/H_THE_DOMINO_CONTROLLER_AND_CONSOLE_OVER.html; http://securityreason.com/securityalert/8164; http://www.lotus.com/ldd/doc/domino_notes/rnext/help6_admin.nsf/2e73cbb2141acefa85256b8700688cea/0c50e423038555d085256c1d003a31f0?OpenDocument
CVE: CVE-2010-3275
Published: 2011-03-28
Description: libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an AMV file, related to a "dangling pointer vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43826; http://securityreason.com/securityalert/8162; http://securitytracker.com/id?1025250
CVE: CVE-2010-3276
Published: 2011-03-28
Description: libdirectx_plugin.dll in VideoLAN VLC Media Player before 1.1.8 allows remote attackers to execute arbitrary code via a crafted width in an NSV file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43826; http://securityreason.com/securityalert/8162; http://securitytracker.com/id?1025250
CVE: CVE-2011-0024
Published: 2011-03-28
Description: Heap-based buffer overflow in wiretap/pcapng.c in Wireshark before 1.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted capture file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/43821; http://www.redhat.com/support/errata/RHSA-2011-0370.html; http://www.vupen.com/english/advisories/2011/0719
CVE: CVE-2011-0439
Published: 2011-03-28
Description: Cross-site scripting (XSS) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to inject arbitrary web script or HTML via the Pieforms select box.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://mahara.org/interaction/forum/topic.php?id=3205; http://mahara.org/interaction/forum/topic.php?id=3208; http://secunia.com/advisories/43858
CVE: CVE-2011-0440
Published: 2011-03-28
Description: Cross-site request forgery (CSRF) vulnerability in Mahara 1.2.x before 1.2.7 and 1.3.x before 1.3.4 allows remote attackers to hijack the authentication of arbitrary users for requests that delete blogs.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-352
References: http://mahara.org/interaction/forum/topic.php?id=3206; http://mahara.org/interaction/forum/topic.php?id=3208; http://secunia.com/advisories/43858
CVE: CVE-2011-0458
Published: 2011-03-28
Description: Untrusted search path vulnerability in the Locate on Disk feature in Google Picasa before 3.8 allows local users to gain privileges via a Trojan horse executable file in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://jvn.jp/en/jp/JVN99977321/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2011-000022; http://osvdb.org/71281
CVE: CVE-2011-0545
Published: 2011-03-28
Description: Cross-site request forgery (CSRF) vulnerability in adduser.do in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to hijack the authentication of administrators for requests that create new administrative accounts, and possibly have unspecified other impact, via the userRole parameter.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://secunia.com/advisories/43820; http://securityreason.com/securityalert/8160; http://securitytracker.com/id?1025242
CVE: CVE-2011-0760
Published: 2011-03-28
Description: Multiple cross-site request forgery (CSRF) vulnerabilities in the configuration screen in wp-relatedposts.php in the WP Related Posts plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the (1) wp_relatedposts_title, (2) wp_relatedposts_num, or (3) wp_relatedposts_type parameter.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/fulldisclosure/2011-03/0205.html; http://secunia.com/advisories/43777; http://www.securityfocus.com/bid/46908
CVE: CVE-2011-1167
Published: 2011-03-28
Description: Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://blackberry.com/btsc/KB27244; http://bugzilla.maptools.org/show_bug.cgi?id=2300; http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
CVE: CVE-2011-1420
Published: 2011-03-28
Description: EMC Data Protection Advisor Collector 5.7 and 5.7.1 on Solaris SPARC platforms uses weak permissions for unspecified files, which allows local users to gain privileges via unknown vectors.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/43893; http://securityreason.com/securityalert/8169; http://securitytracker.com/id?1025253
CVE: CVE-2011-1524
Published: 2011-03-28
Description: Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field, as demonstrated by injecting an IFRAME element into the event log, a different vulnerability than CVE-2011-0545.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://securityreason.com/securityalert/8166; http://securitytracker.com/id?1025242; http://sotiriu.de/adv/NSOADV-2011-001.txt
CVE: CVE-2010-1674
Published: 2011-03-29
Description: The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.
CVSS Score: 5.0 (MEDIUM)
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html; http://rhn.redhat.com/errata/RHSA-2012-1258.html
CVE: CVE-2010-1675
Published: 2011-03-29
Description: bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (session reset) via a malformed AS_PATHLIMIT path attribute.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2011-12/msg00009.html; http://secunia.com/advisories/43499
CVE: CVE-2011-0441
Published: 2011-03-29
Description: The Debian GNU/Linux /etc/cron.d/php5 cron job for PHP 5.3.5 allows local users to delete arbitrary files via a symlink attack on a directory under /var/lib/php5/.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-59
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618489; http://git.debian.org/?p=pkg-php/php.git%3Ba=commit%3Bh=d09fd04ed7bfcf7f008360c6a[PII_REDACTED]5df09; http://www.mandriva.com/security/advisories?name=MDVSA-2011:069
CVE: CVE-2011-0728
Published: 2011-03-29
Description: Cross-site scripting (XSS) vulnerability in templatefunctions.py in Loggerhead before 1.18.1 allows remote authenticated users to inject arbitrary web script or HTML via a filename, which is not properly handled in a revision view.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057413.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057479.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057502.html
CVE: CVE-2011-0892
Published: 2011-03-29
Description: Cross-site scripting (XSS) vulnerability in HP Diagnostics 7.5x and 8.0x before 8.05.54.225 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]6475&w=2; http://secunia.com/advisories/43899; http://securityreason.com/securityalert/8167
CVE: CVE-2011-1176
Published: 2011-03-29
Description: The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
CVSS Score: 4.3 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=618857; http://lists.err.no/pipermail/mpm-itk/2011-March/000393.html; http://lists.err.no/pipermail/mpm-itk/2011-March/000394.html
CVE: CVE-2011-1205
Published: 2011-03-29
Description: Multiple buffer overflows in unspecified COM objects in Rational Common Licensing 7.0 through 7.1.1.4 in IBM Rational ClearCase 7.0.0.4 through 7.1.1.4, ClearQuest 7.0.0.4 through 7.1.1.4, and other products allow local users to gain privileges via a Trojan horse HTML document in the My Computer zone.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-119
References: http://www.ibm.com/support/docview.wss?uid=swg21470998; http://www.securitytracker.com/id?1025268; http://www.securitytracker.com/id?1025269
CVE: CVE-2011-1472
Published: 2011-03-29
Description: The Nokia E75 phone with firmware before 211.12.01 allows physically proximate attackers to bypass the Device Lock code by entering an unspecified button sequence at boot time.
CVSS Score: 7.2 (HIGH)
CWE: CWE-287
References: http://secunia.com/advisories/43827; http://www.cert.fi/en/reports/2011/vulnerability410355.html; http://www.securityfocus.com/bid/47022
CVE: CVE-2009-5064
Published: 2011-03-30
Description: ldd in the GNU C Library (aka glibc or libc6) 2.13 and earlier allows local users to gain privileges via a Trojan horse executable file linked with a modified loader that omits certain LD_TRACE_LOADED_OBJECTS checks.  NOTE: the GNU C Library vendor states "This is just nonsense. There are a gazillion other ways to introduce code if people are downloading arbitrary binaries and install them in appropriate directories or set LD_LIBRARY_PATH etc.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://openwall.com/lists/oss-security/2011/03/07/10; http://openwall.com/lists/oss-security/2011/03/07/13; http://openwall.com/lists/oss-security/2011/03/07/7
CVE: CVE-2011-1097
Published: 2011-03-30
Description: rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-119
References: http://gitweb.samba.org/?p=rsync.git%3Ba=commit%3Bh=83b94efa6b60a3ff5eee4c5f7812c617a90a03f6; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057641.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057736.html
CVE: CVE-2011-1098
Published: 2011-03-30
Description: Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
CVSS Score: 1.9 (LOW)
CWE: CWE-362
References: http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057845.html; http://lists.fedoraproject.org/pipermail/package-announce/2011-March/056992.html; http://openwall.com/lists/oss-security/2011/03/04/16