rainbutterfly/cve_corpus huggingface dataset:
CVE-2012-6033 
The do_tmem_control function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly check privileges, which allows local guest OS users to access control stack operations via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-6034 
The (1) tmemc_save_get_next_page and (2) tmemc_save_get_next_inv functions and the (3) TMEMC_SAVE_GET_POOL_UUID sub-operation in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 "do not check incoming guest output buffer pointers," which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-6035 
The do_tmem_destroy_pool function in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 does not properly validate pool ids, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-6036 
The (1) memc_save_get_next_page, (2) tmemc_restore_put_page and (3) tmemc_restore_flush_page functions in the Transcendent Memory (TMEM) in Xen 4.0, 4.1, and 4.2 do not check for negative id pools, which allows local guest OS users to cause a denial of service (memory corruption and host crash) or possibly execute arbitrary code via unspecified vectors.  NOTE: this issue was originally published as part of CVE-2012-3497, which was too general; CVE-2012-3497 has been SPLIT into this ID and others.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-23T20:00:00.000Z
CVE-2012-6037 
Multiple cross-site scripting (XSS) vulnerabilities in Mahara 1.4.x before 1.4.5 and 1.5.x before 1.5.4, and other versions including 1.2, allow remote attackers to inject arbitrary web script or HTML via a CSV header with "unknown fields," which are not properly handled in error messages in the (1) bulk user, (2) group, and (3) group member upload capabilities.  NOTE: this issue was originally part of CVE-2012-2243, but that ID was SPLIT due to different issues by different researchers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-24T20:00:00.000Z
CVE-2012-6038 
admin/core/admin_func.php in razorCMS before 1.2.1 does not properly restrict access to certain administrator directories and files, which allows remote authenticated users to read, edit, rename, move, copy and delete files via the (1) dir parameter in a fileman or (2) filemanview action.  NOTE: this issue has been referred to as a "path traversal."
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6039 
SQL injection vulnerability in view_comments.php in YABSoft Advanced Image Hosting (AIH) Script, possibly 2.3, allows remote attackers to execute arbitrary SQL commands via the gal parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6040 
Cross-site scripting (XSS) vulnerability in users.php in File King Advanced File Management 1.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6041 
Double free vulnerability in GreenBrowser before 6.0.1002, when the keyword search bar (F6) is activated, allows remote attackers to execute arbitrary code via a crafted iframe.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6042 
GPSMapEdit 1.1.73.2 allows user-assisted remote attackers to cause a denial of service (crash) via a long string in a lst file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6043 
Cross-site scripting (XSS) vulnerability in downloads.php in PHP-Fusion 7.02.04 allows remote attackers to inject arbitrary web script or HTML via the cat_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6044 
M-Player 0.4 allows remote attackers to cause a denial of service (crash) via a crafted MP3 file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-26T22:00:00.000Z
CVE-2012-6045 
Cross-site scripting (XSS) vulnerability in gb/user/index.php in Ramui Forum, possibly 1.0 Beta, allows remote attackers to inject arbitrary web script or HTML via the query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6046 
Static code injection vulnerability in admin/banners.php in PHP Enter allows remote attackers to inject arbitrary PHP code into horad.php via the code parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6047 
Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6048 
Guitar Pro 6.1.1 r10791 allows remote attackers to cause a denial of service (crash) via a long string in a gpx file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6049 
Open Solution Quick.Cart 5.0 allows remote attackers to obtain sensitive information via (1) a long string or (2) invalid characters in a cookie, which reveals the installation path in an error message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6050 
The winbox service in MikroTik RouterOS 5.15 and earlier allows remote attackers to cause a denial of service (CPU consumption), read the router version, and possibly have other impacts via a request to download the router's DLLs or plugins, as demonstrated by roteros.dll.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-27T02:00:00.000Z
CVE-2012-6051 
Google CityHash computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-28T11:00:00.000Z
CVE-2012-6052 
Wireshark 1.8.x before 1.8.4 allows remote attackers to obtain sensitive hostname information by reading pcap-ng files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6053 
epan/dissectors/packet-usb.c in the USB dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 relies on a length field to calculate an offset value, which allows remote attackers to cause a denial of service (infinite loop) via a zero value for this field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6054 
The dissect_sflow_245_address_type function in epan/dissectors/packet-sflow.c in the sFlow dissector in Wireshark 1.8.x before 1.8.4 does not properly handle length calculations for an invalid IP address type, which allows remote attackers to cause a denial of service (infinite loop) via a packet that is neither IPv4 nor IPv6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6055 
epan/dissectors/packet-3g-a11.c in the 3GPP2 A11 dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a zero value in a sub-type length field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6056 
Integer overflow in the dissect_sack_chunk function in epan/dissectors/packet-sctp.c in the SCTP dissector in Wireshark 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Duplicate TSN count.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6057 
The dissect_eigrp_metric_comm function in epan/dissectors/packet-eigrp.c in the EIGRP dissector in Wireshark 1.8.x before 1.8.4 uses the wrong data type for a certain offset value, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6058 
Integer overflow in the dissect_icmpv6 function in epan/dissectors/packet-icmpv6.c in the ICMPv6 dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted Number of Sources value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6059 
The dissect_isakmp function in epan/dissectors/packet-isakmp.c in the ISAKMP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data structure to determine IKEv2 decryption parameters, which allows remote attackers to cause a denial of service (application crash) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6060 
Integer overflow in the dissect_iscsi_pdu function in epan/dissectors/packet-iscsi.c in the iSCSI dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a malformed packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6061 
The dissect_wtp_common function in epan/dissectors/packet-wtp.c in the WTP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 uses an incorrect data type for a certain length field, which allows remote attackers to cause a denial of service (integer overflow and infinite loop) via a crafted value in a packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6062 
The dissect_rtcp_app function in epan/dissectors/packet-rtcp.c in the RTCP dissector in Wireshark 1.6.x before 1.6.12 and 1.8.x before 1.8.4 allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-05T11:00:00.000Z
CVE-2012-6063 
Double free vulnerability in the sftp_mkdir function in sftp.c in libssh before 0.5.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors, a different vector than CVE-2012-4559.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-11-30T22:00:00.000Z
CVE-2012-6064 
Directory traversal vulnerability in lib/filemanager/imagemanager/images.php in CMS Made Simple (CMSMS) before 1.11.2.1 allows remote authenticated administrators to delete arbitrary files via a .. (dot dot) in the deld parameter.  NOTE: this can be leveraged using CSRF (CVE-2012-5450) to allow remote attackers to delete arbitrary files.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-6065 
The OM Maximenu module 6.x-1.43 and earlier for Drupal, when the "Title has PHP" option is enabled, allows remote authenticated users with the "Administer OM Maximenu" permission to execute arbitrary PHP code via a "Link Title," a different vulnerability than CVE-2012-5553.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-03T21:00:00.000Z
CVE-2012-6066 
freeSSHd.exe in freeSSHd through 1.2.6 allows remote attackers to bypass authentication via a crafted session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-04T23:00:00.000Z
CVE-2012-6067 
freeFTPd.exe in freeFTPd through 1.0.11 allows remote attackers to bypass authentication via a crafted SFTP session, as demonstrated by an OpenSSH client with modified versions of ssh.c and sshconnect2.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2012-12-04T23:00:00.000Z
CVE-2012-6068 3S CoDeSys Improper Access Control
The Runtime Toolkit in CODESYS Runtime System 2.3.x and 2.4.x does not require authentication, which allows remote attackers to execute commands via the command-line interface in the TCP listener service or transfer files via requests to the TCP listener service.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: 3S-Smart Software Solutions
product: CODESYS Control Runtime embedded
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CODESYS Control Runtime full
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CODESYS Control RTE
default_status: unaffected
vendor: Festo
product: CECX-X-C1 Modular Master Controller with CoDeSys
default_status: unaffected
vendor: Festo
product: CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CoDeSys
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities.
Published: 2013-01-21T21:00:00.000Z
CVE-2012-6069 3S CoDeSys Relative Path Traversal
The CoDeSys Runtime Toolkit’s file transfer functionality does not 
perform input validation, which allows an attacker to access files and 
directories outside the intended scope. This may allow an attacker to 
upload and download any file on the device. This could allow the 
attacker to affect the availability, integrity, and confidentiality of 
the device.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: 3S-Smart Software Solutions
product: CODESYS Control Runtime embedded
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CODESYS Control Runtime full
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CODESYS Control RTE
default_status: unaffected
vendor: Festo
product: CECX-X-C1 Modular Master Controller with CoDeSys
default_status: unaffected
vendor: Festo
product: CECX-X-M1 Modular Controller with CoDeSys and SoftMotion
default_status: unaffected
vendor: 3S-Smart Software Solutions
product: CoDeSys
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Independent researcher Reid Wightman of IOActive, formerly of Digital Bond has validated that the patch, issued by 3S, mitigates theses vulnerabilities.
Published: 2013-01-21T21:00:00.000Z
CVE-2012-6070 
Falconpl before 0.9.6.9-git20120606 misuses the libcurl API which may allow remote attackers to interfere with security checks.
Problem types: description: Other
Affected products: vendor: falconpl
product: falconpl
Published: 2019-11-19T16:37:19.000Z
CVE-2012-6071 
nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
Problem types: description: Other
Affected products: vendor: nusoap
product: nusoap
Published: 2019-11-19T16:44:00.000Z
CVE-2012-6072 
CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T22:00:00.000Z
CVE-2012-6073 
Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T22:00:00.000Z
CVE-2012-6074 
Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-24T22:00:00.000Z
CVE-2012-6075 
Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-02-13T01:00:00.000Z
CVE-2012-6076 
Inkscape before 0.48.4 reads .eps files from /tmp instead of the current directory, which might cause Inkspace to process unintended files, allow local users to obtain sensitive information, and possibly have other unspecified impacts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-03-12T21:00:00.000Z
CVE-2012-6077 
W3 Total Cache before 0.9.2.5 allows remote attackers to retrieve password hash information due to insecure storage of database cache files.
Problem types: description: Password
Affected products: vendor: W3
product: Total Cache
Published: 2019-11-22T18:44:55.000Z
CVE-2012-6078 
W3 Total Cache before 0.9.2.5 generates hash keys insecurely which allows remote attackers to predict the values of the hashes.
Problem types: description: Password
Affected products: vendor: W3
product: Total Cache
Published: 2019-11-22T18:50:14.000Z
CVE-2012-6079 
W3 Total Cache before 0.9.2.5 exposes sensitive cached database information which allows remote attackers to download this information via their hash keys.
Problem types: description: Other
Affected products: vendor: W3
product: Total Cache
Published: 2019-11-22T18:55:08.000Z
CVE-2012-6080 
Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-03T01:00:00.000Z
CVE-2012-6081 
Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-03T01:00:00.000Z
CVE-2012-6082 
Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-03T01:00:00.000Z
CVE-2012-6083 
Freeciv before 2.3.3 allows remote attackers to cause a denial of service via a crafted packet.
Problem types: description: Other
Affected products: vendor: freeciv
product: freeciv
Published: 2020-01-23T17:57:06.000Z
CVE-2012-6084 
modules/m_capab.c in (1) ircd-ratbox before 3.0.8 and (2) Charybdis before 3.4.2 does not properly support capability negotiation during server handshakes, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-01T15:00:00.000Z
CVE-2012-6085 
The read_block function in g10/import.c in GnuPG 1.4.x before 1.4.13 and 2.0.x through 2.0.19, when importing a key, allows remote attackers to corrupt the public keyring database or cause a denial of service (application crash) via a crafted length field of an OpenPGP packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-24T01:00:00.000Z
CVE-2012-6086 
libs/zbxmedia/eztexting.c in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.8rc1, and 2.1.x before 2.1.2 does not properly set the CURLOPT_SSL_VERIFYHOST option for libcurl, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2014-01-29T18:00:00.000Z
CVE-2012-6087 
repository/s3/S3.php in the Amazon S3 library in Moodle through 2.2.11, 2.3.x before 2.3.9, 2.4.x before 2.4.6, and 2.5.x before 2.5.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, related to an incorrect CURLOPT_SSL_VERIFYHOST value.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-09-16T10:00:00.000Z
CVE-2012-6088 
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass RPM signature checks via a crafted package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-18T11:00:00.000Z
CVE-2012-6089 
Multiple stack-based buffer overflows in the canoniseFileName function in os/pl-os.c in SWI-Prolog before 6.2.5 and 6.3.x before 6.3.7 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted filename.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2013-01-04T11:00:00.000Z