deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2012-2269
Published: 2012-04-20
Description: Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary field to apps/contacts/ajax/addcard.php, (2) the parameter parameter to apps/contacts/ajax/addproperty.php, (3) the name parameter to apps/contacts/ajax/createaddressbook, (4) the file parameter to files/download.php, or the (5) name, (6) user, or (7) redirect_url parameter to files/index.php.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0127.html; http://osvdb.org/81206; http://osvdb.org/81207
CVE: CVE-2012-2270
Published: 2012-04-20
Description: Open redirect vulnerability in index.php (aka the Login Page) in ownCloud before 3.0.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect_url parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-20
References: http://archives.neohapsis.com/archives/bugtraq/2012-04/0127.html; http://osvdb.org/81211; http://owncloud.org/security/advisories/CVE-2012-2270/
CVE: CVE-2012-2397
Published: 2012-04-20
Description: Cross-site request forgery (CSRF) vulnerability in ownCloud before 3.0.3 allows remote attackers to hijack the authentication of arbitrary users for requests that insert cross-site scripting (XSS) sequences via vectors involving contacts.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-352
References: http://owncloud.org/security/advisories/CVE-2012-2397/; http://secunia.com/advisories/48850; http://www.openwall.com/lists/oss-security/2012/08/11/1
CVE: CVE-2012-2398
Published: 2012-04-20
Description: Cross-site scripting (XSS) vulnerability in files/ajax/download.php in ownCloud before 3.0.3 allows remote attackers to inject arbitrary web script or HTML via the files parameter, a different vulnerability than CVE-2012-2269.4.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://owncloud.org/security/advisories/cve-2012-2398/; http://secunia.com/advisories/48850; http://www.openwall.com/lists/oss-security/2012/08/11/1
CVE: CVE-2012-2399
Published: 2012-04-21
Description: Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
CVSS Score: 10.0 (HIGH)
References: http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503; http://jvn.jp/en/jp/JVN25280162/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-002110
CVE: CVE-2012-2400
Published: 2012-04-21
Description: Unspecified vulnerability in wp-includes/js/swfobject.js in WordPress before 3.3.2 has unknown impact and attack vectors.
CVSS Score: 10.0 (HIGH)
References: http://core.trac.wordpress.org/changeset/20499/branches/3.3/wp-includes/js/swfobject.js; http://osvdb.org/81460; http://secunia.com/advisories/49138
CVE: CVE-2012-2401
Published: 2012-04-21
Description: Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-264
References: http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487; http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487; http://osvdb.org/81461
CVE: CVE-2012-2402
Published: 2012-04-21
Description: wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-264
References: http://core.trac.wordpress.org/changeset/20526/branches/3.3/wp-admin/plugins.php; http://osvdb.org/81462; http://secunia.com/advisories/48957
CVE: CVE-2012-2403
Published: 2012-04-21
Description: wp-includes/formatting.php in WordPress before 3.3.2 attempts to enable clickable links inside attributes, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/capabilities.php; http://core.trac.wordpress.org/changeset/20493/branches/3.3/wp-includes/formatting.php; http://osvdb.org/81463
CVE: CVE-2012-2404
Published: 2012-04-21
Description: wp-comments-post.php in WordPress before 3.3.2 supports offsite redirects, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://core.trac.wordpress.org/changeset/20486/branches/3.3/wp-comments-post.php; http://osvdb.org/81464; http://secunia.com/advisories/48957
CVE: CVE-2012-1243
Published: 2012-04-22
Description: The TwitRocker2 application before 1.0.23 for Android does not properly implement the WebView class, which allows remote attackers to obtain sensitive information via a crafted application.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-200
References: http://jvn.jp/en/jp/JVN00000601/index.html; http://jvndb.jvn.jp/jvndb/JVNDB-2012-000033; http://osvdb.org/81447
CVE: CVE-2012-2234
Published: 2012-04-22
Description: Cross-site scripting (XSS) vulnerability in sources/users.queries.php in TeamPass before 2.1.6 allows remote authenticated users to inject arbitrary web script or HTML via the login parameter in an add_new_user action.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://osvdb.org/81197; http://packetstormsecurity.org/files/111905/; http://www.securityfocus.com/bid/53038
CVE: CVE-2012-0216
Published: 2012-04-22
Description: The default configuration of the apache2 package in Debian GNU/Linux squeeze before 2.2.16-6+squeeze7, wheezy before 2.2.22-4, and sid before 2.2.22-4, when mod_php or mod_rivet is used, provides example scripts under the doc/ URI, which might allow local users to conduct cross-site scripting (XSS) attacks, gain privileges, or obtain sensitive information via vectors involving localhost HTTP requests to the Apache HTTP Server.
CVSS Score: 4.4 (MEDIUM)
References: http://www.debian.org/security/2012/dsa-2452; https://exchange.xforce.ibmcloud.com/vulnerabilities/75211; http://www.debian.org/security/2012/dsa-2452
CVE: CVE-2012-0708
Published: 2012-04-22
Description: Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a RegisterSchemaRepoFromFileByDbSet function-prototype mismatch.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://osvdb.org/81443; http://secunia.com/advisories/48933; http://www.ibm.com/support/docview.wss?uid=swg21591705
CVE: CVE-2012-0726
Published: 2012-04-22
Description: The default configuration of TLS in IBM Tivoli Directory Server (TDS) 6.3 and earlier supports the (1) NULL-MD5 and (2) NULL-SHA ciphers, which allows remote attackers to trigger unencrypted communication via the TLS Handshake Protocol.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-310
References: http://www-01.ibm.com/support/docview.wss?uid=swg21591272; http://www.ibm.com/support/docview.wss?uid=swg1IO15761; http://www.ibm.com/support/docview.wss?uid=swg1IO16035
CVE: CVE-2012-0740
Published: 2012-04-22
Description: Cross-site scripting (XSS) vulnerability in the Web Admin Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.22 and 6.3 before 6.3.0.11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://www-01.ibm.com/support/docview.wss?uid=swg24032290; http://www-01.ibm.com/support/docview.wss?uid=swg24032291; http://www.ibm.com/support/docview.wss?uid=swg1IO14508
CVE: CVE-2012-0743
Published: 2012-04-22
Description: IBM Tivoli Directory Server (TDS) 6.3 and earlier allows remote attackers to cause a denial of service (daemon crash) via a malformed LDAP paged search request.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-399
References: http://www-01.ibm.com/support/docview.wss?uid=swg21591267; http://www.ibm.com/support/docview.wss?uid=swg1IO15707; http://www.ibm.com/support/docview.wss?uid=swg1IO16001
CVE: CVE-2012-0946
Published: 2012-04-22
Description: The NVIDIA UNIX driver before 295.40 allows local users to access arbitrary memory locations by leveraging GPU device-node read/write privileges.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/3109; http://secunia.com/advisories/48650; http://secunia.com/advisories/48793
CVE: CVE-2012-1113
Published: 2012-04-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in the administration subsystem in Gallery 2 before 2.3.2 and 3 before 3.0.3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078618.html; http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078752.html
CVE: CVE-2012-1575
Published: 2012-04-22
Description: Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://rhn.redhat.com/errata/RHSA-2012-0476.html; http://rhn.redhat.com/errata/RHSA-2012-0477.html; http://secunia.com/advisories/48810
CVE: CVE-2012-2405
Published: 2012-04-22
Description: Gallery 2 before 2.3.2 and 3 before 3.0.3 does not properly implement encryption, which has unspecified impact and attack vectors, a different vulnerability than CVE-2012-1113.
CVSS Score: 10.0 (HIGH)
CWE: CWE-310
References: http://gallery.menalto.com/gallery_3_0_3_and_gallery_2_3_2; https://bugzilla.redhat.com/show_bug.cgi?id=812045; https://exchange.xforce.ibmcloud.com/vulnerabilities/75201
CVE: CVE-2012-2131
Published: 2012-04-24
Description: Multiple integer signedness errors in crypto/buffer/buffer.c in OpenSSL 0.9.8v allow remote attackers to conduct buffer overflow attacks, and cause a denial of service (memory corruption) or possibly have unspecified other impact, via crafted DER data, as demonstrated by an X.509 certificate or an RSA public key.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-2110.
CVSS Score: 7.5 (HIGH)
CWE: CWE-189
References: http://cvs.openssl.org/chngview?cn=22479; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10673; http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
CVE: CVE-2012-0467
Published: 2012-04-25
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://secunia.com/advisories/48920; http://secunia.com/advisories/48922; http://secunia.com/advisories/48972
CVE: CVE-2012-0468
Published: 2012-04-25
Description: The browser engine in Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (assertion failure and memory corruption) or possibly execute arbitrary code via vectors related to jsval.h and the js::array_shift function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0469
Published: 2012-04-25
Description: Use-after-free vulnerability in the mozilla::dom::indexedDB::IDBKeyRange::cycleCollection::Trace function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to execute arbitrary code via vectors related to crafted IndexedDB data.
CVSS Score: 10.0 (HIGH)
CWE: CWE-399
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0470
Published: 2012-04-25
Description: Heap-based buffer overflow in the nsSVGFEDiffuseLightingElement::LightPixel function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to cause a denial of service (invalid gfxImageSurface free operation) or possibly execute arbitrary code by leveraging the use of "different number systems."
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48920; http://secunia.com/advisories/48922; http://secunia.com/advisories/48972
CVE: CVE-2012-0471
Published: 2012-04-25
Description: Cross-site scripting (XSS) vulnerability in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via a multibyte character set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48920; http://secunia.com/advisories/48922; http://secunia.com/advisories/48972
CVE: CVE-2012-0472
Published: 2012-04-25
Description: The cairo-dwrite implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9, when certain Windows Vista and Windows 7 configurations are used, does not properly restrict font-rendering attempts, which allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49055; http://www.mandriva.com/security/advisories?name=MDVSA-2012:066
CVE: CVE-2012-0473
Published: 2012-04-25
Description: The WebGLBuffer::FindMaxUshortElement function in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 calls the FindMaxElementInSubArray function with incorrect template arguments, which allows remote attackers to obtain sensitive information from video memory via a crafted WebGL.drawElements call.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0474
Published: 2012-04-25
Description: Cross-site scripting (XSS) vulnerability in the docshell implementation in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allows remote attackers to inject arbitrary web script or HTML via vectors related to short-circuited page loads, aka "Universal XSS (UXSS)."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0475
Published: 2012-04-25
Description: Mozilla Firefox 4.x through 11.0, Thunderbird 5.0 through 11.0, and SeaMonkey before 2.9 do not properly construct the Origin and Sec-WebSocket-Origin HTTP headers, which might allow remote attackers to bypass an IPv6 literal ACL via a cross-site (1) XMLHttpRequest or (2) WebSocket operation involving a nonstandard port number and an IPv6 address that contains certain zero fields.
CVSS Score: 2.6 (LOW)
CWE: CWE-264
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0477
Published: 2012-04-25
Description: Multiple cross-site scripting (XSS) vulnerabilities in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to inject arbitrary web script or HTML via the (1) ISO-2022-KR or (2) ISO-2022-CN character set.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/48920; http://secunia.com/advisories/48922; http://secunia.com/advisories/48972
CVE: CVE-2012-0478
Published: 2012-04-25
Description: The texImage2D implementation in the WebGL subsystem in Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 does not properly restrict JSVAL_TO_OBJECT casts, which might allow remote attackers to execute arbitrary code via a crafted web page.
CVSS Score: 9.3 (HIGH)
CWE: CWE-264
References: http://secunia.com/advisories/48972; http://secunia.com/advisories/49047; http://secunia.com/advisories/49055
CVE: CVE-2012-0479
Published: 2012-04-25
Description: Mozilla Firefox 4.x through 11.0, Firefox ESR 10.x before 10.0.4, Thunderbird 5.0 through 11.0, Thunderbird ESR 10.x before 10.0.4, and SeaMonkey before 2.9 allow remote attackers to spoof the address bar via an https URL for invalid (1) RSS or (2) Atom XML content.
CVSS Score: 4.3 (MEDIUM)
References: http://secunia.com/advisories/48920; http://secunia.com/advisories/48922; http://secunia.com/advisories/48972
CVE: CVE-2012-1126
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a BDF font.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1127
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1128
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference and memory corruption) or possibly execute arbitrary code via a crafted TrueType font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00004.html
CVE: CVE-2012-1129
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via a crafted SFNT string in a Type 42 font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1130
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted property data in a PCF font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1131
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, on 64-bit platforms allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors related to the cell table of a font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1132
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via crafted dictionary data in a Type 1 font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1133
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted glyph or bitmap data in a BDF font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1134
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap write operation and memory corruption) or possibly execute arbitrary code via crafted private-dictionary data in a Type 1 font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html
CVE: CVE-2012-1135
Published: 2012-04-25
Description: FreeType before 2.4.9, as used in Mozilla Firefox Mobile before 10.0.4 and other products, allows remote attackers to cause a denial of service (invalid heap read operation and memory corruption) or possibly execute arbitrary code via vectors involving the NPUSHB and NPUSHW instructions in a TrueType font.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2012/Sep/msg00003.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00002.html; http://lists.opensuse.org/opensuse-security-announce/2012-04/msg00003.html