deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2010-3350
Published: 2010-10-20
Description: bareFTP 0.3.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-20
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598284; http://gitorious.org/bareftp/bareftp/blobs/15489abdb4c698cf832e95184bfe769a1ba70238/ChangeLog; http://lists.fedoraproject.org/pipermail/package-announce/2010-December/051921.html
CVE: CVE-2010-3351
Published: 2010-10-20
Description: startBristol in Bristol 0.60.5 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598285; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050784.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050787.html
CVE: CVE-2010-3353
Published: 2010-10-20
Description: Cowbell 0.2.7.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598286; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598286
CVE: CVE-2010-3354
Published: 2010-10-20
Description: dropboxd in Dropbox 0.7.110 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598287; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598287
CVE: CVE-2010-3355
Published: 2010-10-20
Description: Ember 0.5.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598288; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598288
CVE: CVE-2010-3357
Published: 2010-10-20
Description: gnome-subtitles 1.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598289; http://git.gnome.org/browse/gnome-subtitles/commit/?id=44370dc2a87f7fa0d6c[PII_REDACTED]bd407a37c65; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049184.html
CVE: CVE-2010-3358
Published: 2010-10-20
Description: HenPlus JDBC SQL-Shell 0.9.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598290; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598290
CVE: CVE-2010-3360
Published: 2010-10-20
Description: Hipo 0.6.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598291; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598291
CVE: CVE-2010-3361
Published: 2010-10-20
Description: The (1) iked, (2) ikea, and (3) ikec scripts in Shrew Soft IKE 2.1.5 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598292; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598293; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598292
CVE: CVE-2010-3362
Published: 2010-10-20
Description: lastfm 1.5.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598294; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598294
CVE: CVE-2010-3363
Published: 2010-10-20
Description: roarify in roaraudio 0.3 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598295; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598295
CVE: CVE-2010-3364
Published: 2010-10-20
Description: The vips-7.22 script in VIPS 7.22.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598296; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598296
CVE: CVE-2010-3365
Published: 2010-10-20
Description: Mistelix 0.31 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598297; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598297
CVE: CVE-2010-3366
Published: 2010-10-20
Description: Mn_Fit 5.13 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598298; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598298
CVE: CVE-2010-3369
Published: 2010-10-20
Description: The (1) mdb and (2) mdb-symbolreader scripts in mono-debugger 2.4.3, and other versions before 2.8.1, place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598299; http://secunia.com/advisories/42348; http://www.mono-project.com/Vulnerabilities#mono-debugger_Insecure_Use_of_LD_LIBRARY_PATH
CVE: CVE-2010-3376
Published: 2010-10-20
Description: The (1) proofserv, (2) xrdcp, (3) xrdpwdadmin, and (4) xrd scripts in ROOT 5.18/00 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598419; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598420; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598419
CVE: CVE-2010-3377
Published: 2010-10-20
Description: The (1) runSalome, (2) runTestMedCorba, (3) runLightSalome, and (4) hxx2salome scripts in SALOME 5.1.3 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598421; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598421
CVE: CVE-2010-3378
Published: 2010-10-20
Description: The (1) scilab, (2) scilab-cli, and (3) scilab-adv-cli scripts in Scilab 5.2.2 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598422; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598423; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598422
CVE: CVE-2010-3381
Published: 2010-10-20
Description: The (1) tangerine and (2) tangerine-properties scripts in Tangerine 0.3.2.2 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598302; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598302
CVE: CVE-2010-3382
Published: 2010-10-20
Description: tauex in Tuning and Analysis Utilities (TAU) 2.16.4 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598303; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598303
CVE: CVE-2010-3383
Published: 2010-10-20
Description: The (1) teamspeak and (2) teamspeak-server scripts in TeamSpeak 2.0.32 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598304; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598305; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598304
CVE: CVE-2010-3384
Published: 2010-10-20
Description: The (1) torcs, (2) nfsperf, (3) accc, (4) texmapper, (5) trackgen, and (6) nfs2ac scripts in TORCS 1.3.1 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598306; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598306
CVE: CVE-2010-3385
Published: 2010-10-20
Description: TuxGuitar 1.2 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598307; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598307
CVE: CVE-2010-3386
Published: 2010-10-20
Description: usttrace in LTTng Userspace Tracer (aka UST) 0.7 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598309; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598309
CVE: CVE-2010-3387
Published: 2010-10-20
Description: vdrleaktest in Video Disk Recorder (VDR) 1.6.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.  NOTE: a third party disputes this issue because the script erroneously uses a semicolon in a context where a colon was intended
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598308; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598308
CVE: CVE-2010-3389
Published: 2010-10-20
Description: The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598549; http://secunia.com/advisories/43372; http://security.gentoo.org/glsa/glsa-201110-18.xml
CVE: CVE-2010-3393
Published: 2010-10-20
Description: magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598418; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598418
CVE: CVE-2010-3394
Published: 2010-10-20
Description: The (1) texmacs and (2) tm_mupad_help scripts in TeXmacs 1.0.7.4 place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598424; http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=598424
CVE: CVE-2010-4007
Published: 2010-10-20
Description: Oracle Mojarra uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack, a related issue to CVE-2010-2057.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-310
References: https://bugzilla.redhat.com/show_bug.cgi?id=623799; https://issues.apache.org/jira/browse/MYFACES-2749; https://bugzilla.redhat.com/show_bug.cgi?id=623799
CVE: CVE-2010-3170
Published: 2010-10-21
Description: Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-310
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html; http://secunia.com/advisories/41839
CVE: CVE-2010-3173
Published: 2010-10-21
Description: The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly set the minimum key length for Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.
CVSS Score: 7.5 (HIGH)
CWE: CWE-310
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://secunia.com/advisories/41839; http://secunia.com/advisories/42867
CVE: CVE-2010-3174
Published: 2010-10-21
Description: Unspecified vulnerability in the browser engine in Mozilla Firefox 3.5.x before 3.5.14, Thunderbird before 3.0.9, and SeaMonkey before 2.0.9 allows remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://www.debian.org/security/2010/dsa-2124; http://www.mandriva.com/security/advisories?name=MDVSA-2010:210; http://www.mandriva.com/security/advisories?name=MDVSA-2010:211
CVE: CVE-2010-3175
Published: 2010-10-21
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.6.x before 3.6.11 and Thunderbird 3.1.x before 3.1.5 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3176
Published: 2010-10-21
Description: Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox 3.5.x before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3177
Published: 2010-10-21
Description: Multiple cross-site scripting (XSS) vulnerabilities in the Gopher parser in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, and SeaMonkey before 2.0.9, allow remote attackers to inject arbitrary web script or HTML via a crafted name of a (1) file or (2) directory on a Gopher server.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3178
Published: 2010-10-21
Description: Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 do not properly handle certain modal calls made by javascript: URLs in circumstances related to opening a new window and performing cross-domain navigation, which allows remote attackers to bypass the Same Origin Policy via a crafted HTML document.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-264
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3179
Published: 2010-10-21
Description: Stack-based buffer overflow in the text-rendering functionality in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a long argument to the document.write method.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3180
Published: 2010-10-21
Description: Use-after-free vulnerability in the nsBarProp function in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 allows remote attackers to execute arbitrary code by accessing the locationbar property of a closed window.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3181
Published: 2010-10-21
Description: Untrusted search path vulnerability in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Windows allows local users to gain privileges via a Trojan horse DLL in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://www.mozilla.org/security/announce/2010/mfsa2010-71.html; https://bugzilla.mozilla.org/show_bug.cgi?id=589190; https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12116
CVE: CVE-2010-3182
Published: 2010-10-21
Description: A certain application-launch script in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 on Linux places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.
CVSS Score: 6.9 (MEDIUM)
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3183
Published: 2010-10-21
Description: The LookupGetterOrSetter function in js3250.dll in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly support window.__lookupGetter__ function calls that lack arguments, which allows remote attackers to execute arbitrary code or cause a denial of service (incorrect pointer dereference and application crash) via vectors involving a "dangling pointer" and the JS_ValueToId function.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050077.html; http://lists.fedoraproject.org/pipermail/package-announce/2010-October/050154.html
CVE: CVE-2010-3291
Published: 2010-10-21
Description: Cross-site scripting (XSS) vulnerability in HP AssetCenter 5.0x through AC_5.03, and AssetManager 5.1x through AM_5.12 and 5.2x through AM_5.22, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://secunia.com/advisories/41901; http://www.itrc.hp.com/service/cki/docDisplay.do?docId=emr_na-c02535850; http://www.securityfocus.com/bid/44261
CVE: CVE-2010-4033
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly implement the autofill and autocomplete functionality, which allows remote attackers to conduct "profile spamming" attacks via unspecified vectors.
CVSS Score: 5.0 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=48225; http://code.google.com/p/chromium/issues/detail?id=51727; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html
CVE: CVE-2010-4034
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly handle forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=48857; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4035
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly perform autofill operations for forms, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
CVSS Score: 9.3 (HIGH)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=50428; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4036
Published: 2010-10-21
Description: Google Chrome before 7.0.517.41 does not properly handle the unloading of a page, which allows remote attackers to spoof URLs via unspecified vectors.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-20
References: http://code.google.com/p/chromium/issues/detail?id=51680; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4037
Published: 2010-10-21
Description: Unspecified vulnerability in Google Chrome before 7.0.517.41 allows remote attackers to bypass the pop-up blocker via unknown vectors.
CVSS Score: 4.3 (MEDIUM)
References: http://code.google.com/p/chromium/issues/detail?id=53002; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888
CVE: CVE-2010-4038
Published: 2010-10-21
Description: The Web Sockets implementation in Google Chrome before 7.0.517.41 does not properly handle a shutdown action, which allows remote attackers to cause a denial of service (application crash) via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-404
References: http://code.google.com/p/chromium/issues/detail?id=53985; http://googlechromereleases.blogspot.com/2010/10/stable-channel-update.html; http://secunia.com/advisories/41888