vdanen/rhvex-cve huggingface dataset:
CVE-2010-1210 (Moderate severity, published 2010-07-19)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: intl/uconv/util/nsUnicodeDecodeHelper.cpp in Mozilla Firefox before 3.6.7 and Thunderbird before 3.1.1 inserts a U+FFFD sequence into text in certain circumstances involving undefined positions, which might make it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted 8-bit text.
CVE-2010-1085 (Moderate severity, published 2010-02-04)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: The azx_position_ok function in hda_intel.c in Linux kernel 2.6.33-rc4 and earlier, when running on the AMD780V chip set, allows context-dependent attackers to cause a denial of service (crash) via unknown manipulations that trigger a divide-by-zero error.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 3 and Red Hat Enterprise MRG as they did not include the affected function. A future update in Red Hat Enterprise Linux 4 and 5 may address this flaw.
CVE-2010-2216 (Critical severity, published 2010-08-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 9.0.280 and 10.x before 10.1.82.76, and Adobe AIR before 2.0.3, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2010-0209, CVE-2010-2213, and CVE-2010-2214.
CVE-2010-1206 (Low severity, published 2010-04-01)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: The startDocumentLoad function in browser/base/content/browser.js in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, does not properly implement the Same Origin Policy in certain circumstances related to the about:blank document and a document that is currently loading, which allows (1) remote web servers to conduct spoofing attacks via vectors involving a 204 (aka No Content) status code, and allows (2) remote attackers to conduct spoofing attacks via vectors involving a window.stop call.
Statement: The Red Hat Security Response Team has rated this issue as having low
security impact, a future update may address this flaw.
CVE-2010-4454 (Important severity, published 2011-02-14)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Sound and unspecified APIs, a different vulnerability than CVE-2010-4462 and CVE-2010-4473.
CVE-2010-0417 (Critical severity, published 2008-01-13)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption.
CVE-2010-2754 (Moderate severity, published 2010-07-19)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: dom/base/nsJSEnvironment.cpp in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, Thunderbird 3.0.x before 3.0.6 and 3.1.x before 3.1.1, and SeaMonkey before 2.0.6 does not properly suppress a script's URL in certain circumstances involving a redirect and an error message, which allows remote attackers to obtain sensitive information about script parameters via a crafted HTML document, related to the window.onerror handler.
CVE-2010-3846 (Moderate severity, published 2010-10-20)
CVSS score: 3.5 (AV:L/AC:H/Au:S/C:P/I:P/A:P)
CWE: CWE-122
Description: Array index error in the apply_rcs_change function in rcs.c in CVS 1.11.23 allows local users to gain privileges via an RCS file containing crafted delta fragment changes that trigger a heap-based buffer overflow.
CVE-2010-2304 (None severity, published 2010-05-23)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: No description is available for this CVE.
Statement: This is a duplicate of CVE-2010-1773.  CVE-2010-2304 was assigned against WebKit as present in Google Chrome, however CVE-2010-1773 was previously assigned to upstream WebKit.  They are the same issue, however, as noted by the same upstream webkit bug ID (#39508).
CVE-2010-3450 (Moderate severity, published 2011-01-25)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: Multiple directory traversal vulnerabilities in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allow remote attackers to overwrite arbitrary files via a .. (dot dot) in an entry in (1) an XSLT JAR filter description file, (2) an Extension (aka OXT) file, or unspecified other (3) JAR or (4) ZIP files.
CVE-2010-2241 (Low severity, published 2010-05-17)
CVSS score: 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Description: The (1) setup-ds.pl and (2) setup-ds-admin.pl setup scripts for Red Hat Directory Server 8 before 8.2 use world-readable permissions when creating cache files, which allows local users to obtain sensitive information including passwords for Directory and Administration Server administrative accounts.
CVE-2010-3779 (Low severity, published 2010-10-05)
CVSS score: 5.5 (AV:N/AC:L/Au:S/C:P/I:P/A:N)
Description: Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox.
Statement: Not vulnerable. This issue did not affect the versions of dovecot as
shipped with Red Hat Enterprise Linux 4, 5 or 6.
CVE-2010-2168 (Critical severity, published 2010-06-28)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.3.3, and 8.x before 8.2.3 on Windows and Mac OS X, allow attackers to execute arbitrary code via a PDF file with crafted Flash content, involving the newfunction (0x44) operator and an "invalid pointer vulnerability" that triggers memory corruption, a different vulnerability than CVE-2010-1285 and CVE-2010-2201.
CVE-2010-2492 (Important severity, published 2010-07-12)
CVSS score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-119
Description: Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
Statement: The Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, and Red Hat
Enterprise MRG did not include support for eCryptfs, and therefore are not
affected by this issue. A future update in Red Hat Enterprise Linux 6 may
address this flaw.  This was addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2010-0723.html.
CVE-2010-0010 (Low severity, published 2010-01-26)
CVSS score: 4.3 (AV:A/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-190
Description: Integer overflow in the ap_proxy_send_fb function in proxy/proxy_util.c in mod_proxy in the Apache HTTP Server before 1.3.42 on 64-bit platforms allows remote origin servers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a large chunk size that triggers a heap-based buffer overflow.
Statement: This issue does not affect the Apache HTTP Server versions 2 and greater. This flaw does not affect any supported versions of Red Hat Enterprise Linux.

This flaw does affect Red Hat Network Proxy and Red Hat Network Satellite. While those products do not use this feature, we are tracking the issue with the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-0010
CVE-2010-2187 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, and CVE-2010-2188.
CVE-2010-2884 (Critical severity, published 2010-09-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player 10.1.82.76 and earlier on Windows, Mac OS X, Linux, and Solaris and 10.1.92.10 on Android; authplay.dll in Adobe Reader and Acrobat 9.x before 9.4; and authplay.dll in Adobe Reader and Acrobat 8.x before 8.2.5 on Windows and Mac OS X allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in September 2010.
CVE-2010-4301 (Low severity, published 2010-11-17)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
CWE: CWE-835
Description: epan/dissectors/packet-zbee-zcl.c in the ZigBee ZCL dissector in Wireshark 1.4.0 through 1.4.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted ZCL packet, related to Discover Attributes.
Statement: This issue did not affect the versions of wireshark shipped with
Red Hat Enterprise Linux 4, 5, and 6, as they did not include
support for the Zigbee Cluster Library (ZCL) protocol.
CVE-2010-2955 (Moderate severity, published 2010-08-26)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
Description: The cfg80211_wext_giwessid function in net/wireless/wext-compat.c in the Linux kernel before 2.6.36-rc3-next-20100831 does not properly initialize certain structure members, which allows local users to leverage an off-by-one error in the ioctl_standard_iw_point function in net/wireless/wext-core.c, and obtain potentially sensitive information from kernel heap memory, via vectors involving an SIOCGIWESSID ioctl call that specifies a large buffer size.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, and 5 as they did not backport the upstream commit 3d23e349 that had introduced the problem. A future update in Red Hat Enterprise MRG may address this flaw.
CVE-2010-3647 (Critical severity, published 2010-11-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.
CVE-2010-3702 (Important severity, published 2010-09-23)
CVSS score: 5.8 (AV:A/AC:L/Au:N/C:P/I:P/A:P)
Description: The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and possibly other products allows context-dependent attackers to cause a denial of service (crash) via unknown vectors that trigger an uninitialized pointer dereference.
CVE-2010-0084 (Moderate severity, published 2010-03-29)
CVSS score: 5 (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0091.
CVE-2010-4643 (Important severity, published 2011-01-25)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file in an ODF or Microsoft Office document.
CVE-2010-4706 (Low severity, published 2010-10-02)
CVSS score: 1.9 (AV:L/AC:M/Au:N/C:N/I:P/A:N)
Description: The pam_sm_close_session function in pam_xauth.c in the pam_xauth module in Linux-PAM (aka pam) 1.1.2 and earlier does not properly handle a failure to determine a certain target uid, which might allow local users to delete unintended files by executing a program that relies on the pam_xauth PAM check.
Statement: Red Hat does not consider this issue to be a security flaw. For additional details, refer to: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4706
CVE-2010-3493 (Low severity, published 2010-06-29)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Description: Multiple race conditions in smtpd.py in the smtpd module in Python 2.6, 2.7, 3.1, and 3.2 alpha allow remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, or the getpeername function having an ENOTCONN error, a related issue to CVE-2010-3492.
CVE-2010-1787 (Moderate severity, published 2010-08-10)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a floating element in an SVG document.
CVE-2010-0196 (Critical severity, published 2010-04-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, allows attackers to cause a denial of service or possibly execute arbitrary code via unknown vectors, a different vulnerability than CVE-2010-0192 and CVE-2010-0193.
CVE-2010-0179 (Moderate severity, published 2010-03-29)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and SeaMonkey before 2.0.3, when the XMLHttpRequestSpy module in the Firebug add-on is used, does not properly handle interaction between the XMLHttpRequestSpy object and chrome privileged objects, which allows remote attackers to execute arbitrary JavaScript via a crafted HTTP response.
CVE-2010-4205 (Moderate severity, published 2010-11-03)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Google Chrome before 7.0.517.44 does not properly handle the data types of event objects, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.
CVE-2010-4655 (Low severity, published 2010-10-10)
CVSS score: 1.2 (AV:L/AC:H/Au:N/C:P/I:N/A:N)
Description: net/core/ethtool.c in the Linux kernel before 2.6.36 does not initialize certain data structures, which allows local users to obtain potentially sensitive information from kernel heap memory by leveraging the CAP_NET_ADMIN capability for an ethtool ioctl call.
CVE-2010-1400 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving caption elements.
CVE-2010-2943 (Moderate severity, published 2010-06-19)
CVSS score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Description: The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, and Red Hat Enterprise MRG as they did not include support for the XFS file system. A future kernel update in Red Hat Enterprise
Linux 5 will address this issue.
CVE-2010-1396 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to the contentEditable attribute and removing container elements.
CVE-2010-0092 (Moderate severity, published 2010-03-29)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-2806 (Important severity, published 2010-08-04)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: Array index error in the t42_parse_sfnts function in type42/t42parse.c in FreeType before 2.4.2 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via negative size values for certain strings in FontType42 font files, leading to a heap-based buffer overflow.
CVE-2010-3650 (Critical severity, published 2010-11-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3652.
CVE-2010-2942 (Moderate severity, published 2010-08-16)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:P/I:N/A:N)
CWE: CWE-401
Description: The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump operations, which allows local users to obtain potentially sensitive information from kernel memory via vectors related to (1) the tcf_gact_dump function in net/sched/act_gact.c, (2) the tcf_mirred_dump function in net/sched/act_mirred.c, (3) the tcf_nat_dump function in net/sched/act_nat.c, (4) the tcf_simp_dump function in net/sched/act_simple.c, and (5) the tcf_skbedit_dump function in net/sched/act_skbedit.c.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 3 as it did not include upstream commit be84c7f6 (history repository) that introduced the problem. A future kernel update in Red Hat Enterprise Linux 4, 5 and Red Hat Enterprise MRG will address this issue.
CVE-2010-1397 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors related to a layout change during selection rendering and the DOCUMENT_POSITION_DISCONNECTED attribute in a container of an unspecified type.
CVE-2010-0093 (Moderate severity, published 2010-03-29)
CVSS score: 5.1 (AV:N/AC:H/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2010-0095.
CVE-2010-2807 (Moderate severity, published 2010-08-04)
CVSS score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
Description: FreeType before 2.4.2 uses incorrect integer data types during bounds checking, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Statement: Not vulnerable. This issue did not affect the versions of freetype as
shipped with Red Hat Enterprise Linux 3, 4, or 5.
CVE-2010-2387 (None severity, published 2009-02-14)
CVSS score: 1 (AV:L/AC:H/Au:S/C:P/I:N/A:N)
Description: vicious-extensions/ve-misc.c in GNOME Display Manager (gdm) 2.20.x before 2.20.11, when GDM debug is enabled, logs the user password when it contains invalid UTF8 encoded characters, which might allow local users to gain privileges by reading the information from syslog logs.
Statement: This is not a vulnerability.  Red Hat Enterprise Linux does not have /var/log/messages world-readable, nor is GDM run in debug mode; both are requirements for this to be considered a flaw.
CVE-2010-1401 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving the :first-letter pseudo-element.
CVE-2010-4253 (Important severity, published 2011-01-25)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-122
Description: Heap-based buffer overflow in Impress in OpenOffice.org (OOo) 2.x and 3.x before 3.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PNG file in an ODF or Microsoft Office document, as demonstrated by a PowerPoint (aka PPT) document.
CVE-2010-3083 (Moderate severity, published 2010-10-06)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Description: sys/ssl/SslSocket.cpp in qpidd in Apache Qpid, as used in Red Hat Enterprise MRG before 1.2.2 and other products, when SSL is enabled, allows remote attackers to cause a denial of service (daemon outage) by connecting to the SSL port but not participating in an SSL handshake.
CVE-2010-4746 (Low severity, published 2010-12-15)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
CWE: CWE-401
Description: Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of service (memory consumption) via "badly behaved applications," related to (1) Slapi_Attr mishandling in the DN normalization code and (2) pointer mishandling in the syntax normalization code, a different issue than CVE-2011-0019.
Statement: Not vulnerable. This issue did not affect Red Hat Directory Server 8 packages.
CVE-2010-1790 (Moderate severity, published 2010-08-10)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; does not properly handle just-in-time (JIT) compiled JavaScript stubs, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted HTML document, related to a "reentrancy issue."
CVE-2010-3257 (Moderate severity, published 2010-09-01)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Use-after-free vulnerability in WebKit, as used in Apple Safari before 4.1.3 and 5.0.x before 5.0.3, Google Chrome before 6.0.472.53, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving element focus.