deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2009-3796
Published: 2009-12-10
Description: Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors, related to a "data injection vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://osvdb.org/60886
CVE: CVE-2009-3797
Published: 2009-12-10
Description: Adobe Flash Player 10.x before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://secunia.com/advisories/37584
CVE: CVE-2009-3798
Published: 2009-12-10
Description: Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might allow attackers to execute arbitrary code via unspecified vectors that trigger memory corruption.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://secunia.com/advisories/37584
CVE: CVE-2009-3799
Published: 2009-12-10
Description: Integer overflow in the Verifier::parseExceptionHandlers function in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allows remote attackers to execute arbitrary code via an SWF file with a large exception_count value that triggers memory corruption, related to "generation of ActionScript exception handlers."
CVSS Score: 9.3 (HIGH)
CWE: CWE-189
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://osvdb.org/60889
CVE: CVE-2009-3800
Published: 2009-12-10
Description: Multiple unspecified vulnerabilities in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 allow attackers to cause a denial of service (application crash) or possibly execute arbitrary code via unknown vectors.
CVSS Score: 9.3 (HIGH)
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://secunia.com/advisories/37584
CVE: CVE-2009-3951
Published: 2009-12-10
Description: Unspecified vulnerability in the Flash Player ActiveX control in Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 on Windows allows remote attackers to obtain the names of local files via unknown vectors.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2008-4820.
CVSS Score: 7.1 (HIGH)
CWE: CWE-200
References: http://lists.apple.com/archives/security-announce/2010/Jan/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2009-12/msg00003.html; http://osvdb.org/60891
CVE: CVE-2009-3845
Published: 2009-12-10
Description: The port-3443 HTTP server in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostname parameter to unspecified Perl scripts.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://www.securityfocus.com/archive/1/508345/100/0/threaded
CVE: CVE-2009-3846
Published: 2009-12-10
Description: Multiple heap-based buffer overflows in ovlogin.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via a long (1) userid or (2) passwd parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-08; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-3847
Published: 2009-12-10
Description: Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://www.securityfocus.com/bid/37261
CVE: CVE-2009-3848
Published: 2009-12-10
Description: Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Template parameter, related to the vsprintf function.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://www.securityfocus.com/archive/1/508346/100/0/threaded
CVE: CVE-2009-3849
Published: 2009-12-10
Description: Multiple stack-based buffer overflows in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via (1) a long Template parameter to nnmRptConfig.exe, related to the strcat function; or (2) a long Oid parameter to snmp.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://www.securityfocus.com/archive/1/508348/100/0/threaded
CVE: CVE-2009-4176
Published: 2009-12-10
Description: Multiple heap-based buffer overflows in ovsessionmgr.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allow remote attackers to execute arbitrary code via a long (1) userid or (2) passwd parameter to ovlogin.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-09; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-4177
Published: 2009-12-10
Description: Buffer overflow in webappmon.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-10; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-4178
Published: 2009-12-10
Description: Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long Topic parameter.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-11; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-4179
Published: 2009-12-10
Description: Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Accept-Language header in an OVABverbose action.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-12; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-4180
Published: 2009-12-10
Description: Stack-based buffer overflow in snmpviewer.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a long HTTP Host header.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-13; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-4181
Published: 2009-12-10
Description: Stack-based buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via vectors involving the sel and arg parameters to jovgraph.exe.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://dvlabs.tippingpoint.com/advisory/TPTI-09-14; http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2
CVE: CVE-2009-0898
Published: 2009-12-10
Description: Stack-based buffer overflow in HP OpenView Network Node Manager (OV NNM) 7.01, 7.51, and 7.53 allows remote attackers to execute arbitrary code via a crafted HTTP request.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01950877; http://marc.info/?l=bugtraq&m=[PII_REDACTED]0442&w=2; http://www.iss.net/threats/357.html
CVE: CVE-2009-4237
Published: 2009-12-10
Description: Multiple cross-site scripting (XSS) vulnerabilities in TestLink before 1.8.5 allow remote attackers to inject arbitrary web script or HTML via (1) the req parameter to login.php, and allow remote authenticated users to inject arbitrary web script or HTML via (2) the key parameter to lib/general/staticPage.php, (3) the tableName parameter to lib/attachments/attachmentupload.php, or the (4) startDate, (5) endDate, or (6) logLevel parameter to lib/events/eventviewer.php; (7) the search_notes_string parameter to lib/results/resultsMoreBuilds_buildReport.php; or the (8) expected_results, (9) name, (10) steps, or (11) summary parameter in a find action to lib/testcases/searchData.php, related to lib/functions/database.class.php.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html; http://osvdb.org/60914; http://osvdb.org/60915
CVE: CVE-2009-4238
Published: 2009-12-10
Description: Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the Test Case ID field to lib/general/navBar.php or (2) the logLevel parameter to lib/events/eventviewer.php.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-89
References: http://archives.neohapsis.com/archives/fulldisclosure/2009-12/0221.html; http://osvdb.org/60919; http://osvdb.org/60920
CVE: CVE-2009-4292
Published: 2009-12-10
Description: Buffer overflow in the URL filtering function in Internet Initiative Japan SEIL/X1, SEIL/X2, and SEIL/B1 firmware 2.40 through 2.51 allows remote attackers to execute arbitrary code via unspecified vectors.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://jvn.jp/en/jp/JVN06362164/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000069.html; http://osvdb.org/59362
CVE: CVE-2009-4293
Published: 2009-12-10
Description: Internet Initiative Japan SEIL/X1, SEIL/X2, and SEIL/B1 firmware 2.30 through 2.51, when NAT is enabled, allows remote attackers to cause a denial of service (system restart) via crafted GRE packets.
CVSS Score: 7.1 (HIGH)
CWE: CWE-16
References: http://jvn.jp/en/jp/JVN13011682/index.html; http://jvndb.jvn.jp/en/contents/2009/JVNDB-2009-000070.html; http://osvdb.org/59361
CVE: CVE-2009-3027
Published: 2009-12-11
Description: VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection Server (CPS) 11d, 12.0, and 12.5; Veritas NetBackup Operations Manager (NOM) 6.0 GA through 6.5.5; Veritas Backup Reporter (VBR) 6.0 GA through 6.6; Veritas Storage Foundation (SF) 3.5; Veritas Storage Foundation for Windows High Availability (SFWHA) 4.3MP2, 5.0, 5.0RP1a, 5.0RP2, 5.1, and 5.1AP1; Veritas Storage Foundation for High Availability (SFHA) 3.5; Veritas Storage Foundation for Oracle (SFO) 4.1, 5.0, and 5.0.1; Veritas Storage Foundation for DB2 4.1 and 5.0; Veritas Storage Foundation for Sybase 4.1 and 5.0; Veritas Storage Foundation for Oracle Real Application Cluster (SFRAC) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Manager (SFM) 1.0, 1.0 MP1, 1.1, 1.1.1Ux, 1.1.1Win, and 2.0; Veritas Cluster Server (VCS) 3.5, 4.0, 4.1, and 5.0; Veritas Cluster Server One (VCSOne) 2.0, 2.0.1, and 2.0.2; Veritas Application Director (VAD) 1.1 and 1.1 Platform Expansion; Veritas Cluster Server Management Console (VCSMC) 5.1, 5.5, and 5.5.1; Veritas Storage Foundation Cluster File System (SFCFS) 3.5, 4.0, 4.1, and 5.0; Veritas Storage Foundation Cluster File System for Oracle RAC (SFCFS RAC) 5.0; Veritas Command Central Storage (CCS) 4.x, 5.0, and 5.1; Veritas Command Central Enterprise Reporter (CC-ER) 5.0 GA, 5.0 MP1, 5.0 MP1RP1, and 5.1; Veritas Command Central Storage Change Manager (CC-SCM) 5.0 and 5.1; and Veritas MicroMeasure 5.0 does not properly validate authentication requests, which allows remote attackers to trigger the unpacking of a WAR archive, and execute arbitrary code in the contained files, via crafted data to TCP port 14300.
CVSS Score: 10.0 (HIGH)
CWE: CWE-287
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]7330&w=2; http://secunia.com/advisories/37631; http://secunia.com/advisories/37637
CVE: CVE-2009-4124
Published: 2009-12-11
Description: Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust.  NOTE: some of these details are obtained from third party information.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37660; http://www.osvdb.org/60880; http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/
CVE: CVE-2009-4135
Published: 2009-12-11
Description: The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-59
References: http://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=ae034822c535fa5; http://marc.info/?l=oss-security&m=[PII_REDACTED]3441&w=2; http://secunia.com/advisories/37645
CVE: CVE-2009-4294
Published: 2009-12-11
Description: Unspecified vulnerability in the Authentication Manager (aka utauthd) in Sun Ray Server Software 4.0 and 4.1 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
CVSS Score: 10.0 (HIGH)
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-07-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-267548-1; http://www.securityfocus.com/bid/37284
CVE: CVE-2009-4295
Published: 2009-12-11
Description: Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA private key for the firmware on each Sun Ray 1, 1g, 100, and 150 DTU device, which makes it easier for remote attackers to obtain sensitive information by predicting a key and then using it to decrypt sniffed network traffic.
CVSS Score: 7.8 (HIGH)
CWE: CWE-310
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-127553-07-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-270549-1; http://www.securityfocus.com/bid/37285
CVE: CVE-2009-4296
Published: 2009-12-11
Description: SQL injection vulnerability in the Taxonomy Timer module 5.x-1.8 and earlier and 6.x-alpha1 and earlier for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-89
References: http://drupal.org/node/641050; http://drupal.org/node/641064; http://drupal.org/node/649396
CVE: CVE-2009-3906
Published: 2009-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-3606.  Reason: This candidate is a duplicate of CVE-2009-3606.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2009-3606 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-3907
Published: 2009-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-3607.  Reason: This candidate is a duplicate of CVE-2009-3607.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2009-3607 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-3908
Published: 2009-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2009-3608.  Reason: This candidate is a duplicate of CVE-2009-3608.  A typo caused the wrong ID to be used.  Notes: All CVE users should reference CVE-2009-3608 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-4132
Published: 2009-12-12
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2009-4214.  Reason: This candidate is a duplicate of CVE-2009-4214.  Notes: All CVE users should reference CVE-2009-4214 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2009-4131
Published: 2009-12-13
Description: The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel before 2.6.32-git6 allows local users to overwrite arbitrary files via a crafted request, related to insufficient checks for file permissions.
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://git.kernel.org/?p=linux/kernel/git/tytso/ext4.git%3Ba=commit%3Bh=4a58579b9e4e2a35d57e6c9c8483e52f6f1b7fd6; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://lkml.org/lkml/2009/12/9/255
CVE: CVE-2009-4210
Published: 2009-12-13
Description: The Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted media content.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302; http://support.microsoft.com/kb/954157
CVE: CVE-2009-4306
Published: 2009-12-13
Description: Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ext4 filesystem in the Linux kernel 2.6.32-git6 and earlier allows local users to cause a denial of service (filesystem corruption) via unknown vectors, a different vulnerability than CVE-2009-4131.
CVSS Score: 4.9 (MEDIUM)
References: http://grsecurity.org/test/grsecurity-2.1.14-2.6.32[PII_REDACTED]57.patch; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://secunia.com/advisories/38017
CVE: CVE-2009-4307
Published: 2009-12-13
Description: The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 2.6.32-git6 allows user-assisted remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value).
CVSS Score: 7.1 (HIGH)
CWE: CWE-189
References: http://bugzilla.kernel.org/show_bug.cgi?id=14287; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=503358ae01b70ce6909d19dd01287093f6b6271c; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html
CVE: CVE-2009-4308
Published: 2009-12-13
Description: The ext4_decode_error function in fs/ext4/super.c in the ext4 filesystem in the Linux kernel before 2.6.32 allows user-assisted remote attackers to cause a denial of service (NULL pointer dereference), and possibly have unspecified other impact, via a crafted read-only filesystem that lacks a journal.
CVSS Score: 7.1 (HIGH)
CWE: CWE-399
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=78f1ddbb498283c2445c11b0dfa666424c301803; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00000.html; http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00005.html
CVE: CVE-2009-4309
Published: 2009-12-13
Description: Heap-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via a large size value in a movi record in an IV41 stream in a media file, as demonstrated by an AVI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302; http://support.microsoft.com/kb/954157
CVE: CVE-2009-4310
Published: 2009-12-13
Description: Stack-based buffer overflow in the Intel Indeo41 codec for Windows Media Player in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted compressed video data in an IV41 stream in a media file, leading to many loop iterations, as demonstrated by data in an AVI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302; http://support.microsoft.com/kb/954157
CVE: CVE-2009-4311
Published: 2009-12-13
Description: Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Paul Byrne of NGS Software.  NOTE: this might overlap CVE-2008-3615.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302; http://support.microsoft.com/kb/954157
CVE: CVE-2009-4312
Published: 2009-12-13
Description: Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content, as reported to Microsoft by Dave Lenoe of Adobe.
CVSS Score: 9.3 (HIGH)
CWE: CWE-94
References: http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302; http://support.microsoft.com/kb/954157
CVE: CVE-2009-4313
Published: 2009-12-13
Description: ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2 allows remote attackers to cause a denial of service (heap corruption) or execute arbitrary code via malformed data in a stream in a media file, as demonstrated by an AVI file.
CVSS Score: 9.3 (HIGH)
CWE: CWE-119
References: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=835; http://secunia.com/advisories/37592; http://securitytracker.com/id?1023302
CVE: CVE-2009-4129
Published: 2009-12-14
Description: Race condition in Mozilla Firefox allows remote attackers to produce a JavaScript message with a spoofed domain association by writing the message in between the document request and document load for a web page in a different domain.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-362
References: http://archives.neohapsis.com/archives/bugtraq/2009-12/0104.html; http://securitytracker.com/id?1023287; http://www.securityfocus.com/bid/37230
CVE: CVE-2009-4130
Published: 2009-12-14
Description: Visual truncation vulnerability in the MakeScriptDialogTitle function in nsGlobalWindow.cpp in Mozilla Firefox allows remote attackers to spoof the origin domain name of a script via a long name.
CVSS Score: 5.8 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2009-12/0104.html; http://securitytracker.com/id?1023287; http://www.securityfocus.com/bid/37232
CVE: CVE-2009-4314
Published: 2009-12-14
Description: Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group Hotdesking (AMGH) is enabled, responds to a logout action by immediately logging the user in again, which makes it easier for physically proximate attackers to obtain access to a session by going to an unattended DTU device.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-264
References: http://sunsolve.sun.com/search/document.do?assetkey=1-21-139548-03-1; http://sunsolve.sun.com/search/document.do?assetkey=1-66-268228-1; http://sunsolve.sun.com/search/document.do?assetkey=1-21-139548-03-1