deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2013-1469
Published: 2013-03-13
Description: Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a .. (dot dot) in the dl parameter.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-22
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html; http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html; http://piwigo.org/bugs/view.php?id=0002843
CVE: CVE-2013-1814
Published: 2013-03-14
Description: The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html; http://www.exploit-db.com/exploits/24744/; http://archives.neohapsis.com/archives/bugtraq/2013-03/0078.html
CVE: CVE-2012-4446
Published: 2013-03-14
Description: The default configuration for Apache Qpid 0.20 and earlier, when the federation_tag attribute is enabled, accepts AMQP connections without checking the source user ID, which allows remote attackers to bypass authentication and have other unspecified impact via an AMQP request.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-287
References: http://rhn.redhat.com/errata/RHSA-2013-0561.html; http://rhn.redhat.com/errata/RHSA-2013-0562.html; http://secunia.com/advisories/52516
CVE: CVE-2012-4458
Published: 2013-03-14
Description: The AMQP type decoder in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (memory consumption and server crash) via a large number of zero width elements in the client-properties map in a connection.start-ok message.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2013-0561.html; http://rhn.redhat.com/errata/RHSA-2013-0562.html; http://secunia.com/advisories/52516
CVE: CVE-2012-4459
Published: 2013-03-14
Description: Integer overflow in the qpid::framing::Buffer::checkAvailable function in Apache Qpid 0.20 and earlier allows remote attackers to cause a denial of service (crash) via a crafted message, which triggers an out-of-bounds read.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://rhn.redhat.com/errata/RHSA-2013-0561.html; http://rhn.redhat.com/errata/RHSA-2013-0562.html; http://secunia.com/advisories/52516
CVE: CVE-2012-4460
Published: 2013-03-14
Description: The serializing/deserializing functions in the qpid::framing::Buffer class in Apache Qpid 0.20 and earlier allow remote attackers to cause a denial of service (assertion failure and daemon exit) via unspecified vectors.  NOTE: this issue could also trigger an out-of-bounds read, but it might not trigger a crash.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-119
References: http://svn.apache.org/viewvc?view=revision&revision=1453031; https://bugzilla.redhat.com/show_bug.cgi?id=861242; https://issues.apache.org/jira/browse/QPID-4629
CVE: CVE-2012-4462
Published: 2013-03-14
Description: aviary/jobcontrol.py in Condor, as used in Red Hat Enterprise MRG 2.3, when removing a job, allows remote attackers to cause a denial of service (condor_schedd restart) via square brackets in the cproc option.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20
References: http://rhn.redhat.com/errata/RHSA-2013-0564.html; http://rhn.redhat.com/errata/RHSA-2013-0565.html; https://bugzilla.redhat.com/show_bug.cgi?id=860850
CVE: CVE-2013-0275
Published: 2013-03-14
Description: Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-79
References: http://ganglia.info/?p=566; http://www.openwall.com/lists/oss-security/2013/02/08/6; http://www.securityfocus.com/bid/58204
CVE: CVE-2013-1049
Published: 2013-03-14
Description: Buffer overflow in the RFC1413 (ident) client in cfingerd 1.4.3-3 allows remote IDENT servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted response.
CVSS Score: 10.0 (HIGH)
CWE: CWE-119
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700098; http://osvdb.org/90747; http://www.debian.org/security/2013/dsa-2635
CVE: CVE-2013-1423
Published: 2013-03-14
Description: (1) contrib/gforge-3.0-cronjobs.patch, (2) cronjobs/homedirs.php, (3) deb-specific/fileforge.pl, (4) deb-specific/group_dump_update.pl, (5) deb-specific/ssh_dump_update.pl, (6) deb-specific/user_dump_update.pl, (7) plugins/scmbzr/common/BzrPlugin.class.php, (8) plugins/scmcvs/common/CVSPlugin.class.php, (9) plugins/scmcvs/cronjobs/cvs.php, (10) plugins/scmcvs/cronjobs/ssh_create.php, (11) plugins/scmgit/common/GitPlugin.class.php, (12) plugins/scmsvn/common/SVNPlugin.class.php, (13) plugins/wiki/cronjobs/create_groups.php, (14) utils/cvs1/cvscreate.sh, and (15) utils/include.pl in FusionForge 5.0, 5.1, and 5.2 allows local users to change arbitrary file permissions, obtain sensitive information, and have other unspecified impacts via a (1) symlink or (2) hard link attack on certain files.
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-59
References: http://osvdb.org/90605; http://secunia.com/advisories/52318; http://secunia.com/advisories/52371
CVE: CVE-2013-1468
Published: 2013-03-14
Description: Cross-site request forgery (CSRF) vulnerability in the LocalFiles Editor plugin in Piwigo before 2.4.7 allows remote attackers to hijack the authentication of administrators for requests that create arbitrary PHP files via unspecified vectors.
CVSS Score: 7.6 (HIGH)
CWE: CWE-352
References: http://archives.neohapsis.com/archives/bugtraq/2013-02/0153.html; http://packetstormsecurity.com/files/120592/Piwigo-2.4.6-Cross-Site-Request-Forgery-Traversal.html; http://piwigo.org/bugs/view.php?id=0002844
CVE: CVE-2013-1667
Published: 2013-03-14
Description: The rehash mechanism in Perl 5.8.2 through 5.16.x allows context-dependent attackers to cause a denial of service (memory consumption and crash) via a crafted hash key.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=702296; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735
CVE: CVE-2013-1794
Published: 2013-03-14
Description: Buffer overflow in certain client utilities in OpenAFS before 1.6.2 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via a long fileserver ACL entry.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-119
References: http://secunia.com/advisories/52342; http://secunia.com/advisories/52480; http://www.debian.org/security/2013/dsa-2638
CVE: CVE-2013-1795
Published: 2013-03-14
Description: Integer overflow in ptserver in OpenAFS before 1.6.2 allows remote attackers to cause a denial of service (crash) via a large list from the IdToName RPC, which triggers a heap-based buffer overflow.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-189
References: http://secunia.com/advisories/52342; http://secunia.com/advisories/52480; http://www.debian.org/security/2013/dsa-2638
CVE: CVE-2012-6138
Published: 2013-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2012-6536, CVE-2012-6537, CVE-2012-6538, CVE-2012-6539, CVE-2012-6540, CVE-2012-6541, CVE-2012-6542, CVE-2012-6543, CVE-2012-6544, CVE-2012-6545, CVE-2012-6546, CVE-2012-6547, CVE-2012-6548, CVE-2012-6549.  Reason: This candidate is a duplicate of CVE-2012-6536, CVE-2012-6537, CVE-2012-6538, CVE-2012-6539, CVE-2012-6540, CVE-2012-6541, CVE-2012-6542, CVE-2012-6543, CVE-2012-6544, CVE-2012-6545, CVE-2012-6546, CVE-2012-6547, CVE-2012-6548, and CVE-2012-6549.  Notes: All CVE users should reference one or more of CVE-2012-6536, CVE-2012-6537, CVE-2012-6538, CVE-2012-6539, CVE-2012-6540, CVE-2012-6541, CVE-2012-6542, CVE-2012-6543, CVE-2012-6544, CVE-2012-6545, CVE-2012-6546, CVE-2012-6547, CVE-2012-6548, and CVE-2012-6549 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2012-6536
Published: 2013-03-15
Description: net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not verify that the actual Netlink message length is consistent with a certain header field, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability and providing a (1) new or (2) updated state.
CVSS Score: 2.1 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ecd[PII_REDACTED]e423dd87fcc0c077da557909720; http://www.openwall.com/lists/oss-security/2013/03/05/13; https://github.com/torvalds/linux/commit/ecd[PII_REDACTED]e423dd87fcc0c077da557909720
CVE: CVE-2012-6537
Published: 2013-03-15
Description: net/xfrm/xfrm_user.c in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=1f86840f897717f86d523a13e99a447e6a5d2fa5; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7b789836f434c87168eab067cfbed1ec4783dffd; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f778a636713a435d3a922c60b1622a91136560c1
CVE: CVE-2012-6538
Published: 2013-03-15
Description: The copy_to_user_auth function in net/xfrm/xfrm_user.c in the Linux kernel before 3.6 uses an incorrect C library function for copying a string, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4c87308bdea31a7b4828a51f6156e6f721a1fcc9; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://www.openwall.com/lists/oss-security/2013/03/05/13
CVE: CVE-2012-6539
Published: 2013-03-15
Description: The dev_ifconf function in net/socket.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=43da5f2e0d0c69ded3d51907d9552310a6b545e8; http://www.openwall.com/lists/oss-security/2013/03/05/13; http://www.ubuntu.com/usn/USN-1792-1
CVE: CVE-2012-6540
Published: 2013-03-15
Description: The do_ip_vs_get_ctl function in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 3.6 does not initialize a certain structure for IP_VS_SO_GET_TIMEOUT commands, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2d8a041b7bfe1097af21441cb77d6af95f4f4680; http://www.openwall.com/lists/oss-security/2013/03/05/13; http://www.ubuntu.com/usn/USN-1792-1
CVE: CVE-2012-6541
Published: 2013-03-15
Description: The ccid3_hc_tx_getsockopt function in net/dccp/ccids/ccid3.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=7b07f8eb75aa3097cdfd4f6eac3da49db787381d; http://www.openwall.com/lists/oss-security/2013/03/05/13; https://github.com/torvalds/linux/commit/7b07f8eb75aa3097cdfd4f6eac3da49db787381d
CVE: CVE-2012-6542
Published: 2013-03-15
Description: The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel before 3.6 has an incorrect return value in certain circumstances, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that leverages an uninitialized pointer argument.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3592aaeb80290bda0f2cf0b5456c97bfc638b192; http://rhn.redhat.com/errata/RHSA-2013-1645.html; http://www.openwall.com/lists/oss-security/2013/03/05/13
CVE: CVE-2012-6543
Published: 2013-03-15
Description: The l2tp_ip6_getname function in net/l2tp/l2tp_ip6.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=04d4fbca1017c11381e7d82acea21dd741e748bc; http://www.openwall.com/lists/oss-security/2013/03/05/13; https://github.com/torvalds/linux/commit/04d4fbca1017c11381e7d82acea21dd741e748bc
CVE: CVE-2012-6544
Published: 2013-03-15
Description: The Bluetooth protocol stack in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application that targets the (1) L2CAP or (2) HCI implementation.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3f68ba07b1da811bf383b4b701b129bfcb2e4988; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=792039c73cf176c8e39a6e8beef2c94ff46522ed; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e15ca9a0ef9a86f0477530b0f44a725d67f889ee
CVE: CVE-2012-6545
Published: 2013-03-15
Description: The Bluetooth RFCOMM implementation in the Linux kernel before 3.6 does not properly initialize certain structures, which allows local users to obtain sensitive information from kernel memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9344a972961d1a6d2c04d9008b13617bcb6ec2ef; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9ad2de43f1aee7e7274a4e0d[PII_REDACTED]9e344b; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f9432c5ec8b1e9a09b9b0e5569e3c73db8de432a
CVE: CVE-2012-6546
Published: 2013-03-15
Description: The ATM implementation in the Linux kernel before 3.6 does not initialize certain structures, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3c0c5cfdcd4d69ffc4b9c0907cec99039f30a50a; http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e862f1a9b7df4e8196ebec45ac62295138aa3fc2; http://rhn.redhat.com/errata/RHSA-2013-0744.html
CVE: CVE-2012-6547
Published: 2013-03-15
Description: The __tun_chr_ioctl function in drivers/net/tun.c in the Linux kernel before 3.6 does not initialize a certain structure, which allows local users to obtain sensitive information from kernel stack memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a117dacde0288f3ec60b6e5bcedae8fa37ee0dfc; http://rhn.redhat.com/errata/RHSA-2013-0744.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2012-6548
Published: 2013-03-15
Description: The udf_encode_fh function in fs/udf/namei.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=0143fc5e9f6f5aad[PII_REDACTED]bc8d4b4a278200; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://rhn.redhat.com/errata/RHSA-2013-1051.html
CVE: CVE-2012-6549
Published: 2013-03-15
Description: The isofs_export_encode_fh function in fs/isofs/export.c in the Linux kernel before 3.6 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel heap memory via a crafted application.
CVSS Score: 1.9 (LOW)
CWE: CWE-200
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fe685aabf7c8c9f138e5ea900954d295bf229175; http://lists.opensuse.org/opensuse-security-announce/2013-07/msg00018.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2013-1825
Published: 2013-03-15
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2013-2546, CVE-2013-2547, CVE-2013-2548.  Reason: This candidate is a duplicate of CVE-2013-2546, CVE-2013-2547, and CVE-2013-2548.  Notes: All CVE users should reference one or more of CVE-2013-2546, CVE-2013-2547, and CVE-2013-2548 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2013-2546
Published: 2013-03-15
Description: The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2013-2547
Published: 2013-03-15
Description: The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 does not initialize certain structure members, which allows local users to obtain sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2013-2548
Published: 2013-03-15
Description: The crypto_report_one function in crypto/crypto_user.c in the report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect length value during a copy operation, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability.
CVSS Score: 2.1 (LOW)
CWE: CWE-310
References: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6; http://lists.opensuse.org/opensuse-updates/2013-12/msg00129.html; http://www.mandriva.com/security/advisories?name=MDVSA-2013:176
CVE: CVE-2013-0248
Published: 2013-03-15
Description: The default configuration of javax.servlet.context.tempdir in Apache Commons FileUpload 1.0 through 1.2.2 uses the /tmp directory for uploaded files, which allows local users to overwrite arbitrary files via an unspecified symlink attack.
CVSS Score: 3.3 (LOW)
CWE: CWE-264
References: http://archives.neohapsis.com/archives/bugtraq/2013-03/0035.html; http://marc.info/?l=bugtraq&m=[PII_REDACTED]1375&w=2; http://www.oracle.com/technetwork/security-advisory/cpuoct2[PII_REDACTED].html
CVE: CVE-2013-0960
Published: 2013-03-15
Description: WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2013-0961.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html
CVE: CVE-2013-0961
Published: 2013-03-15
Description: WebKit in Apple Safari before 6.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, a different vulnerability than CVE-2013-0960.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00003.html
CVE: CVE-2013-0966
Published: 2013-03-15
Description: The Apple mod_hfs_apple module for the Apache HTTP Server in Apple Mac OS X before 10.8.3 does not properly handle ignorable Unicode characters, which allows remote attackers to bypass intended directory authentication requirements via a crafted pathname in a URI.
CVSS Score: 6.4 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0967
Published: 2013-03-15
Description: CoreTypes in Apple Mac OS X before 10.8.3 includes JNLP files in the list of safe file types, which allows remote attackers to bypass a Java plug-in disabled setting, and trigger the launch of Java Web Start applications, via a crafted web site.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0969
Published: 2013-03-15
Description: Login Window in Apple Mac OS X before 10.8.3 does not prevent application launching with the VoiceOver feature, which allows physically proximate attackers to bypass authentication and make arbitrary System Preferences changes via unspecified use of the keyboard.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-264
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0970
Published: 2013-03-15
Description: Messages in Apple Mac OS X before 10.8.3 allows remote attackers to bypass the FaceTime call-confirmation prompt via a crafted FaceTime: URL.
CVSS Score: 4.3 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0971
Published: 2013-03-15
Description: Use-after-free vulnerability in PDFKit in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted ink annotations in a PDF document.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-399
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0973
Published: 2013-03-15
Description: Software Update in Apple Mac OS X through 10.7.5 does not prevent plugin loading within the marketing-text WebView, which allows man-in-the-middle attackers to execute plugin code by modifying the client-server data stream.
CVSS Score: 6.8 (MEDIUM)
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
CVE: CVE-2013-0976
Published: 2013-03-15
Description: IOAcceleratorFamily in Apple Mac OS X before 10.8.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted graphics image.
CVSS Score: 6.8 (MEDIUM)
CWE: CWE-119
References: http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html; http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html