morpheuslord/cve-llm-training huggingface dataset:
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1073.

assistant: crontab.c in crontab in FreeBSD and Apple Mac OS X allows local users to (1) determine the existence of arbitrary files via a symlink attack on a /tmp/crontab.XXXXXXXXXX temporary file and (2) perform MD5 checksum comparisons on arbitrary pairs of files via two symlink attacks on /tmp/crontab.XXXXXXXXXX temporary files.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1074.

assistant: crontab.c in crontab in FreeBSD allows local users to determine the existence of arbitrary directories via a command-line argument composed of a directory name concatenated with a directory traversal sequence that leads to the /etc/crontab pathname.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1075.

assistant: FreeBSD's crontab calculates the MD5 sum of the previous and new cronjob to determine if any changes have been made before copying the new version in. In particular, it uses the MD5File() function, which takes a pathname as an argument, and is called with euid 0. A race condition in this process may lead to an arbitrary MD5 comparison regardless of the read permissions.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1076.

assistant: net/dns_resolver/dns_key.c in the Linux kernel before 2.6.38 allows remote DNS servers to cause a denial of service (NULL pointer dereference and OOPS) by not providing a valid response to a DNS query, as demonstrated by an erroneous grand.centrall.org query, which triggers improper handling of error data within a DNS resolver key.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1077.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Apache Archiva 1.0 through 1.2.2, and 1.3.x before 1.3.5, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1078.

assistant: The sco_sock_getsockopt_old function in net/bluetooth/sco.c in the Linux kernel before 2.6.39 does not initialize a certain structure, which allows local users to obtain potentially sensitive information from kernel stack memory via the SCO_CONNINFO option.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1079.

assistant: The bnep_sock_ioctl function in net/bluetooth/bnep/sock.c in the Linux kernel before 2.6.39 does not ensure that a certain device field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory, or cause a denial of service (BUG and system crash), via a BNEPCONNADD command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1080.

assistant: The do_replace function in net/bridge/netfilter/ebtables.c in the Linux kernel before 2.6.39 does not ensure that a certain name field ends with a '\0' character, which allows local users to obtain potentially sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability to replace a table, and then reading a modprobe command line.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1081.

assistant: modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1082.

assistant: fs/eventpoll.c in the Linux kernel before 2.6.38 places epoll file descriptors within other epoll data structures without properly checking for (1) closed loops or (2) deep chains, which allows local users to cause a denial of service (deadlock or stack memory consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1083.

assistant: The epoll implementation in the Linux kernel 2.6.37.2 and earlier does not properly traverse a tree of epoll file descriptors, which allows local users to cause a denial of service (CPU consumption) via a crafted application that makes epoll_create and epoll_ctl system calls.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1084.

assistant: A cross-site scripting (XSS) vulnerability in Smoothwall Express 3.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1085.

assistant: CSRF vulnerability in Smoothwall Express 3.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1086.

assistant: Cross-site scripting (XSS) vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1087.

assistant: Buffer overflow in VideoLAN VLC media player 1.0.5 allows user-assisted remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via a crafted .mp3 file that is played during bookmark creation.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1088.

assistant: Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1089.

assistant: The addmntent function in the GNU C Library (aka glibc or libc6) 2.13 and earlier does not report an error status for failed attempts to write to the /etc/mtab file, which makes it easier for local users to trigger corruption of this file, as demonstrated by writes from a process with a small RLIMIT_FSIZE value, a different vulnerability than CVE-2010-0296.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1090.

assistant: The __nfs4_proc_set_acl function in fs/nfs/nfs4proc.c in the Linux kernel before 2.6.38 stores NFSv4 ACL data in memory that is allocated by kmalloc but not properly freed, which allows local users to cause a denial of service (panic) via a crafted attempt to set an ACL.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1091.

assistant: libymsg.c in the Yahoo! protocol plugin in libpurple in Pidgin 2.6.0 through 2.7.10 allows (1) remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG notification packet, and allows (2) remote Yahoo! servers to cause a denial of service (NULL pointer dereference and application crash) via a malformed YMSG SMS message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1092.

assistant: Integer overflow in ext/shmop/shmop.c in PHP before 5.3.6 allows context-dependent attackers to cause a denial of service (crash) and possibly read sensitive memory via a large third argument to the shmop_read function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1093.

assistant: The dccp_rcv_state_process function in net/dccp/input.c in the Datagram Congestion Control Protocol (DCCP) implementation in the Linux kernel before 2.6.38 does not properly handle packets for a CLOSED endpoint, which allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by sending a DCCP-Close packet followed by a DCCP-Reset packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1094.

assistant: kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1095.

assistant: locale/programs/locale.c in locale in the GNU C Library (aka glibc or libc6) before 2.13 does not quote its output, which might allow local users to gain privileges via a crafted localization environment variable, in conjunction with a program that executes a script that uses the eval function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1096.

assistant: The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on SOAP responses, aka "character encoding pattern attack."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1097.

assistant: rsync 3.x before 3.0.8, when certain recursion, deletion, and ownership options are used, allows remote rsync servers to cause a denial of service (heap memory corruption and application crash) or possibly execute arbitrary code via malformed data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1098.

assistant: Race condition in the createOutputFile function in logrotate.c in logrotate 3.7.9 and earlier allows local users to read log data by opening a file before the intended permissions are in place.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1099.

assistant: Multiple directory traversal vulnerabilities in FocalMedia.Net Quick Polls before 1.0.2 allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the p parameter in a preview action to index.php, or (2) delete arbitrary files via a .. (dot dot) in the p parameter in a delete action to index.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1100.

assistant: Multiple SQL injection vulnerabilities in admin/index.php in Pixelpost 1.7.3 allow remote authenticated users to execute arbitrary SQL commands via the (1) findfid, (2) id, (3) selectfcat, (4) selectfmon, or (5) selectftag parameter in an images action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1101.

assistant: Multiple unspecified vulnerabilities in a third-party component of the Citrix Licensing Administration Console 11.6, formerly License Management Console, allow remote attackers to (1) access unauthorized "license administration functionality" or (2) cause a denial of service via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1102.

assistant: Cross-site scripting (XSS) vulnerability in the WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1103.

assistant: The WebReporting module in F-Secure Policy Manager 7.x, 8.00 before hotfix 2, 8.1x before hotfix 3 on Windows and hotfix 2 on Linux, and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux, allows remote attackers to obtain sensitive information via a request to an invalid report, which reveals the installation path in an error message, as demonstrated with requests to (1) report/infection-table.html or (2) report/productsummary-table.html.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1104.

assistant: Multiple cross-site request forgery (CSRF) vulnerabilities in Mutare EVM allow remote attackers to hijack the authentication of arbitrary users for requests that (1) change a PIN, (2) delete messages, (3) add a delivery address, or (4) change a delivery address.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1105.

assistant: Multiple cross-site scripting (XSS) vulnerabilities in Mutare EVM allow remote attackers to inject arbitrary web script or HTML via (1) a delivery address and possibly (2) a PIN.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1106.

assistant: Cross-site scripting (XSS) vulnerability in stcenter.nsf in the server in IBM Lotus Sametime allows remote attackers to inject arbitrary web script or HTML via the authReasonCode parameter in an OpenDatabase action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1107.

assistant: Unspecified vulnerability in Google Chrome before 9.0.597.107 allows remote attackers to spoof the URL bar via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1108.

assistant: Google Chrome before 9.0.597.107 does not properly implement JavaScript dialogs, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1109.

assistant: Google Chrome before 9.0.597.107 does not properly process nodes in Cascading Style Sheets (CSS) stylesheets, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1110.

assistant: Google Chrome before 9.0.597.107 does not properly implement key frame rules, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1111.

assistant: Google Chrome before 9.0.597.107 does not properly implement forms controls, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1112.

assistant: Google Chrome before 9.0.597.107 does not properly perform SVG rendering, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1113.

assistant: Google Chrome before 9.0.597.107 on 64-bit Linux platforms does not properly perform pickle deserialization, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1114.

assistant: Google Chrome before 9.0.597.107 does not properly handle tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1115.

assistant: Google Chrome before 9.0.597.107 does not properly render tables, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1116.

assistant: Google Chrome before 9.0.597.107 does not properly handle SVG animations, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1117.

assistant: Google Chrome before 9.0.597.107 does not properly handle XHTML documents, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to "stale nodes."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1118.

assistant: Google Chrome before 9.0.597.107 does not properly handle TEXTAREA elements, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted HTML document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1119.

assistant: Google Chrome before 9.0.597.107 does not properly determine device orientation, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1120.

assistant: The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71717.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1121.

assistant: Integer overflow in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving a TEXTAREA element.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1122.

assistant: The WebGL implementation in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors, aka Issue 71960.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1123.

assistant: Google Chrome before 9.0.597.107 does not properly restrict access to internal extension functions, which has unspecified impact and remote attack vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1124.

assistant: Use-after-free vulnerability in Google Chrome before 9.0.597.107 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to blocked plug-ins.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1125.

assistant: Google Chrome before 9.0.597.107 does not properly perform layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1126.

assistant: VMware vmrun, as used in VIX API 1.x before 1.10.3 and VMware Workstation 6.5.x and 7.x before 7.1.4 build 385536 on Linux, might allow local users to gain privileges via a Trojan horse shared library in an unspecified directory.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1127.

assistant: SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1128.

assistant: The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1129.

assistant: Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1130.

assistant: Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1131.

assistant: The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1132.

assistant: The IPv6 implementation in the kernel in Apple Mac OS X before 10.6.8 allows local users to cause a denial of service (NULL pointer dereference and reboot) via vectors involving socket options.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1133.

assistant: Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code via plugins/ExtendedFileManager/backend.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1134.

assistant: Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in the image manager.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1135.

assistant: Cross-Site Scripting (XSS) in Xinha, as included in the Serendipity package before 1.5.5, allows remote attackers to execute arbitrary code in plugins/ExtendedFileManager/manager.php and plugins/ImageManager/manager.php.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1136.

assistant: In tesseract 2.03 and 2.04, an attacker can rewrite an arbitrary user file by guessing the PID and creating a link to the user's file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1137.

assistant: Integer overflow in the mod_sftp (aka SFTP) module in ProFTPD 1.3.3d and earlier allows remote attackers to cause a denial of service (memory consumption leading to OOM kill) via a malformed SSH message.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1138.

assistant: Off-by-one error in the dissect_6lowpan_iphc function in packet-6lowpan.c in Wireshark 1.4.0 through 1.4.3 on 32-bit platforms allows remote attackers to cause a denial of service (application crash) via a malformed 6LoWPAN IPv6 packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1139.

assistant: wiretap/pcapng.c in Wireshark 1.2.0 through 1.2.14 and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (application crash) via a pcap-ng file that contains a large packet-length field.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1140.

assistant: Multiple stack consumption vulnerabilities in the dissect_ms_compressed_string and dissect_mscldap_string functions in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allow remote attackers to cause a denial of service (infinite recursion) via a crafted (1) SMB or (2) Connection-less LDAP (CLDAP) packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1141.

assistant: epan/dissectors/packet-ldap.c in Wireshark 1.0.x, 1.2.0 through 1.2.14, and 1.4.0 through 1.4.3 allows remote attackers to cause a denial of service (memory consumption) via (1) a long LDAP filter string or (2) an LDAP filter string containing many elements.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1142.

assistant: Stack consumption vulnerability in the dissect_ber_choice function in the BER dissector in Wireshark 1.2.x through 1.2.15 and 1.4.x through 1.4.4 might allow remote attackers to cause a denial of service (infinite loop) via vectors involving self-referential ASN.1 CHOICE values.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1143.

assistant: epan/dissectors/packet-ntlmssp.c in the NTLMSSP dissector in Wireshark before 1.4.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted .pcap file.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1144.

assistant: The installer in PEAR 1.9.2 and earlier allows local users to overwrite arbitrary files via a symlink attack on the package.xml file, related to the (1) download_dir, (2) cache_dir, (3) tmp_dir, and (4) pear-build-download directories.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1072.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1145.

assistant: The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1146.

assistant: libvirt.c in the API in Red Hat libvirt 0.8.8 does not properly restrict operations in a read-only connection, which allows remote attackers to cause a denial of service (host OS crash) or possibly execute arbitrary code via a (1) virNodeDeviceDettach, (2) virNodeDeviceReset, (3) virDomainRevertToSnapshot, (4) virDomainSnapshotDelete, (5) virNodeDeviceReAttach, or (6) virConnectDomainXMLToNative call, a different vulnerability than CVE-2008-5086.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1147.

assistant: Multiple stack-based and heap-based buffer overflows in the (1) decode_open_type and (2) udptl_rx_packet functions in main/udptl.c in Asterisk Open Source 1.4.x before 1.4.39.2, 1.6.1.x before 1.6.1.22, 1.6.2.x before 1.6.2.16.2, and 1.8 before 1.8.2.4; Business Edition C.x.x before C.3.6.3; AsteriskNOW 1.5; and s800i (Asterisk Appliance), when T.38 support is enabled, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted UDPTL packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1148.

assistant: Use-after-free vulnerability in the substr_replace function in PHP 5.3.6 and earlier allows context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by using the same variable for multiple arguments.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1149.

assistant: Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1150.

assistant: bbPress through 1.0.2 has XSS in /bb-login.php url via the re parameter.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1151.

assistant: Joomla! 1.6.0 is vulnerable to SQL Injection via the filter_order and filer_order_Dir parameters.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1153.

assistant: Multiple format string vulnerabilities in phar_object.c in the phar extension in PHP 5.3.5 and earlier allow context-dependent attackers to obtain sensitive information from process memory, cause a denial of service (memory corruption), or possibly execute arbitrary code via format string specifiers in an argument to a class method, leading to an incorrect zend_throw_exception_ex call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1154.

assistant: The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1155.

assistant: The writeState function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to cause a denial of service (rotation outage) via a (1) \n (newline) or (2) \ (backslash) character in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1156.

assistant: feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1157.

assistant: Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1158.

assistant: Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1159.

assistant: acpid.c in acpid before 2.0.9 does not properly handle a situation in which a process has connected to acpid.socket but is not reading any data, which allows local users to cause a denial of service (daemon hang) via a crafted application that performs a connect system call but no read system calls.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1160.

assistant: The tpm_open function in drivers/char/tpm/tpm.c in the Linux kernel before 2.6.39 does not initialize a certain buffer, which allows local users to obtain potentially sensitive information from kernel memory via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1162.

assistant: The tpm_read function in the Linux kernel 2.6 does not properly clear memory, which might allow local users to read the results of the previous TPM command.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1163.

assistant: The osf_partition function in fs/partitions/osf.c in the Linux kernel before 2.6.38 does not properly handle an invalid number of partitions, which might allow local users to obtain potentially sensitive information from kernel heap memory via vectors related to partition-table parsing.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1164.

assistant: Vino before 2.99.4 can connect external networks contrary to the statement in the vino-preferences dialog box, which might make it easier for remote attackers to perform attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1165.

assistant: Vino, possibly before 3.2, does not properly document that it opens ports in UPnP routers when the "Configure network to automatically accept connections" setting is enabled, which might make it easier for remote attackers to perform further attacks.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1166.

assistant: Xen, possibly before 4.0.2, allows local 64-bit PV guests to cause a denial of service (host crash) by specifying user mode execution without user-mode pagetables.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1167.

assistant: Heap-based buffer overflow in the thunder (aka ThunderScan) decoder in tif_thunder.c in LibTIFF 3.9.4 and earlier allows remote attackers to execute arbitrary code via crafted THUNDER_2BITDELTAS data in a .tiff file that has an unexpected BitsPerSample value.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1168.

assistant: Cross-site scripting (XSS) vulnerability in the KHTMLPart::htmlError function in khtml/khtml_part.cpp in Konqueror in KDE SC 4.4.0 through 4.6.1 allows remote attackers to inject arbitrary web script or HTML via the URI in a URL corresponding to an unavailable web site.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1169.

assistant: Array index error in the asihpi_hpi_ioctl function in sound/pci/asihpi/hpioctl.c in the AudioScience HPI driver in the Linux kernel before 2.6.38.1 might allow local users to cause a denial of service (memory corruption) or possibly gain privileges via a crafted adapter index value that triggers access to an invalid kernel pointer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1170.

assistant: net/ipv4/netfilter/arp_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1171.

assistant: net/ipv4/netfilter/ip_tables.c in the IPv4 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1172.

assistant: net/ipv6/netfilter/ip6_tables.c in the IPv6 implementation in the Linux kernel before 2.6.39 does not place the expected '\0' character at the end of string data in the values of certain structure members, which allows local users to obtain potentially sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability to issue a crafted request, and then reading the argument to the resulting modprobe process.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1173.

assistant: The econet_sendmsg function in net/econet/af_econet.c in the Linux kernel before 2.6.39 on the x86_64 platform allows remote attackers to obtain potentially sensitive information from kernel stack memory by reading uninitialized data in the ah field of an Acorn Universal Networking (AUN) packet.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1174.

assistant: manager.c in Asterisk Open Source 1.6.1.x before 1.6.1.24, 1.6.2.x before 1.6.2.17.2, and 1.8.x before 1.8.3.2 allows remote attackers to cause a denial of service (CPU and memory consumption) via a series of manager sessions involving invalid data.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1175.

assistant: tcptls.c in the TCP/TLS server in Asterisk Open Source 1.6.1.x before 1.6.1.23, 1.6.2.x before 1.6.2.17.1, and 1.8.x before 1.8.3.1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) by establishing many short TCP sessions to services that use a certain TLS API.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1176.

assistant: The configuration merger in itk.c in the Steinar H. Gunderson mpm-itk Multi-Processing Module 2.2.11-01 and 2.2.11-02 for the Apache HTTP Server does not properly handle certain configuration sections that specify NiceValue but not AssignUserID, which might allow remote attackers to gain privileges by leveraging the root uid and root gid of an mpm-itk process.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1178.

assistant: Multiple integer overflows in the load_image function in file-pcx.c in the Personal Computer Exchange (PCX) plugin in GIMP 2.6.x and earlier allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PCX image that triggers a heap-based buffer overflow.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1179.

assistant: The SPICE Firefox plug-in (spice-xpi) 2.4, 2.3, 2.2, and possibly other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to (1) plugin/nsScriptablePeer.cpp and (2) plugin/plugin.cpp, which trigger multiple uses of an uninitialized pointer.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1180.

assistant: Multiple stack-based buffer overflows in the iriap_getvaluebyclass_indication function in net/irda/iriap.c in the Linux kernel before 2.6.39 allow remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact by leveraging connectivity to an IrDA infrared network and sending a large integer value for a (1) name length or (2) attribute length.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1182.

assistant: kernel/signal.c in the Linux kernel before 2.6.39 allows local users to spoof the uid and pid of a signal sender via a sigqueueinfo system call.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1183.

assistant: Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application.  NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1184.

assistant: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1185.

assistant: Google Chrome before 10.0.648.127 does not prevent (1) navigation and (2) close operations on the top location of a sandboxed frame, which has unspecified impact and remote attack vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1186.

assistant: Google Chrome before 10.0.648.127 on Linux does not properly handle parallel execution of calls to the print method, which might allow remote attackers to cause a denial of service (application crash) via crafted JavaScript code.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1187.

assistant: Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1188.

assistant: Google Chrome before 10.0.648.127 does not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1189.

assistant: Google Chrome before 10.0.648.127 does not properly perform box layout, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale node."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1190.

assistant: The Web Workers implementation in Google Chrome before 10.0.648.127 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, related to an "error message leak."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1191.

assistant: Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the handling of DOM URLs.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1192.

assistant: Google Chrome before 10.0.648.127 on Linux does not properly handle Unicode ranges, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1193.

assistant: Google V8, as used in Google Chrome before 10.0.648.127, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1194.

assistant: Multiple unspecified vulnerabilities in Google Chrome before 10.0.648.127 allow remote attackers to bypass the pop-up blocker via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1195.

assistant: Use-after-free vulnerability in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to "document script lifetime handling."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1196.

assistant: The OGG container implementation in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger an out-of-bounds write.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1197.

assistant: Google Chrome before 10.0.648.127 does not properly perform table painting, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1198.

assistant: The video functionality in Google Chrome before 10.0.648.127 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that trigger use of a malformed "out-of-bounds structure."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1199.

assistant: Google Chrome before 10.0.648.127 does not properly handle DataView objects, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via unknown vectors.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1200.

assistant: Google Chrome before 10.0.648.127 does not properly perform a cast of an unspecified variable during text rendering, which allows remote attackers to cause a denial of service or possibly have unknown other impact via a crafted document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1201.

assistant: The context implementation in WebKit, as used in Google Chrome before 10.0.648.127, allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1202.

assistant: The xsltGenerateIdFunction function in functions.c in libxslt 1.1.26 and earlier, as used in Google Chrome before 10.0.648.127 and other products, allows remote attackers to obtain potentially sensitive information about heap memory addresses via an XML document containing a call to the XSLT generate-id XPath function.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1203.

assistant: Google Chrome before 10.0.648.127 does not properly handle SVG cursors, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors that lead to a "stale pointer."
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1204.

assistant: Google Chrome before 10.0.648.127 does not properly handle attributes, which allows remote attackers to cause a denial of service (DOM tree corruption) or possibly have unspecified other impact via a crafted document.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1205.

assistant: Multiple buffer overflows in unspecified COM objects in Rational Common Licensing 7.0 through 7.1.1.4 in IBM Rational ClearCase 7.0.0.4 through 7.1.1.4, ClearQuest 7.0.0.4 through 7.1.1.4, and other products allow local users to gain privileges via a Trojan horse HTML document in the My Computer zone.
user: Describe the vulnerability: Provide detailed information about the vulnerability for CVE-2011-1206.

assistant: Stack-based buffer overflow in the server process in ibmslapd.exe in IBM Tivoli Directory Server (TDS) 5.2 before 5.2.0.5-TIV-ITDS-IF0010, 6.0 before 6.0.0.67 (aka 6.0.0.8-TIV-ITDS-IF0009), 6.1 before 6.1.0.40 (aka 6.1.0.5-TIV-ITDS-IF0003), 6.2 before 6.2.0.16 (aka 6.2.0.3-TIV-ITDS-IF0002), and 6.3 before 6.3.0.3 (aka 6.3.0.0-TIV-ITDS-IF0003) allows remote attackers to execute arbitrary code via a crafted LDAP request.  NOTE: some of these details are obtained from third party information.