vdanen/rhvex-cve huggingface dataset:
CVE-2010-0087 (Important severity, published 2010-03-29)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java Web Start, Java Plug-in component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-3701 (Moderate severity, published 2010-09-13)
CVSS score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
Description: lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2 allows remote authenticated users to cause a denial of service (stack memory exhaustion and broker crash) via a large persistent message.
CVE-2010-2813 (Low severity, published 2010-07-22)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Description: functions/imap_general.php in SquirrelMail before 1.4.21 does not properly handle 8-bit characters in passwords, which allows remote attackers to cause a denial of service (disk consumption) by making many IMAP login attempts with different usernames, leading to the creation of many preferences files.
Statement: The Red Hat Security Response Team has rated this issue as having low security
impact, a future update may address this flaw.
CVE-2010-4494 (Low severity, published 2010-11-16)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Description: Double free vulnerability in libxml2 2.7.8 and other versions, as used in Google Chrome before 8.0.552.215 and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to XPath handling.
Statement: This issue did not affect the versions of libxml and libxml2 as shipped with
Red Hat Enterprise Linux 3, and it did not affect the version of libxml2 as
shipped with Red Hat Enterprise Linux 4 and 5.
CVE-2010-3644 (Critical severity, published 2010-11-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, CVE-2010-3650, and CVE-2010-3652.
CVE-2010-2956 (Important severity, published 2010-09-06)
CVSS score: 6 (AV:L/AC:H/Au:S/C:C/I:C/A:C)
Description: Sudo 1.7.0 through 1.7.4p3, when a Runas group is configured, does not properly handle use of the -u option in conjunction with the -g option, which allows local users to gain privileges via a command line containing a "-u root" sequence.
CVE-2010-2055 (Moderate severity, published 2010-05-25)
CVSS score: 4.4 (AV:L/AC:M/Au:N/C:P/I:P/A:P)
Description: Ghostscript 8.71 and earlier reads initialization files from the current working directory, which allows local users to execute arbitrary PostScript commands via a Trojan horse file, related to improper support for the -P- option to the gs program, as demonstrated using gs_init.ps, a different vulnerability than CVE-2010-4820.
CVE-2010-3869 (Moderate severity, published 2010-11-07)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
Description: Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
CVE-2010-1157 (Low severity, published 2010-04-20)
CVSS score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
Description: Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
Statement: The risks associated with fixing this flaw are greater than the low severity security risk. We therefore have no plans to fix this flaw. The information leak can be avoided by adjusting the configuration to always specify a realm-name.
CVE-2010-2794 (Low severity, published 2010-08-24)
CVSS score: 2.1 (AV:L/AC:L/Au:N/C:N/I:P/A:N)
Description: The SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows local users to overwrite arbitrary files via a symlink attack on an unspecified log file.
CVE-2010-0195 (Critical severity, published 2010-04-12)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.3.2, and 8.x before 8.2.2 on Windows and Mac OS X, do not properly handle fonts, which allows attackers to execute arbitrary code via unspecified vectors.
CVE-2010-1784 (Moderate severity, published 2010-08-10)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: The counters functionality in the Cascading Style Sheets (CSS) implementation in WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted HTML document.
CVE-2010-3613 (Important severity, published 2010-11-30)
CVSS score: 4 (AV:N/AC:L/Au:S/C:N/I:N/A:P)
Description: named in ISC BIND 9.6.2 before 9.6.2-P3, 9.6-ESV before 9.6-ESV-R3, and 9.7.x before 9.7.2-P3 does not properly handle the combination of signed negative responses and corresponding RRSIG records in the cache, which allows remote attackers to cause a denial of service (daemon crash) via a query for cached data.
CVE-2010-2901 (Moderate severity, published 2010-07-09)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: The rendering implementation in Google Chrome before 5.0.375.125 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVE-2010-4343 (Moderate severity, published 2010-05-20)
CVSS score: 4.7 (AV:L/AC:M/Au:N/C:N/I:N/A:C)
Description: drivers/scsi/bfa/bfa_core.c in the Linux kernel before 2.6.35 does not initialize a certain port data structure, which allows local users to cause a denial of service (system crash) via read operations on an fc_host statistics file.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat
Enterprise Linux 4 as it did not include support for the Brocade Fibre Channel Host Bus Adapter driver. It did not affect the version of Linux kernels as shipped with Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG as they have the included the fix for this issue. A future kernel update in Red Hat Enterprise Linux 5 may address this flaw.
CVE-2010-1511 (Important severity, published 2010-05-12)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-22
Description: KGet 2.4.2 in KDE SC 4.0.0 through 4.4.3 does not properly request download confirmation from the user, which makes it easier for remote attackers to overwrite arbitrary files via a crafted metalink file.
CVE-2010-4206 (Moderate severity, published 2010-11-03)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Array index error in the FEBlend::apply function in WebCore/platform/graphics/filters/FEBlend.cpp in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted SVG document, related to effects in the application of filters.
CVE-2010-4656 (Moderate severity, published 2010-10-21)
CVSS score: 6.2 (AV:L/AC:H/Au:N/C:C/I:C/A:C)
Description: The iowarrior_write function in drivers/usb/misc/iowarrior.c in the Linux kernel before 2.6.37 does not properly allocate memory, which might allow local users to trigger a heap-based buffer overflow, and consequently cause a denial of service or gain privileges, via a long report.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 4 and 5 as they do not have support for the I/O-Warrior USB devices. This has been addressed in Red Hat Enterprise MRG via https://rhn.redhat.com/errata/RHSA-2011-0330.html. A future kernel update in Red Hat Enterprise Linux 6 may address this flaw.
CVE-2010-1792 (Moderate severity, published 2010-08-10)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: WebKit in Apple Safari before 5.0.1 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1.1 on Mac OS X 10.4; and webkitgtk before 1.2.6; allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression.
CVE-2010-3255 (Moderate severity, published 2010-09-01)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
Description: Google Chrome before 6.0.472.53 and webkitgtk before 1.2.6 do not properly handle counter nodes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.
CVE-2010-0183 (Critical severity, published 2010-06-21)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in the nsCycleCollector::MarkRoots function in Mozilla Firefox 3.5.x before 3.5.10 and SeaMonkey before 2.0.5 allows remote attackers to execute arbitrary code via a crafted HTML document, related to an improper frame construction process for menus.
CVE-2010-1815 (Moderate severity, published 2010-09-07)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit in Apple iOS before 4.1 on the iPhone and iPod touch, and webkitgtk before 1.2.6, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving scrollbars.
CVE-2010-3081 (Important severity, published 2010-09-14)
CVSS score: 7.2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-119
Description: The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory required for the 32-bit compatibility layer, which allows local users to gain privileges by leveraging the ability of the compat_mc_getsockopt function (aka the MCAST_MSFILTER getsockopt support) to control a certain length value, related to a "stack pointer underflow" issue, as exploited in the wild in September 2010.
Statement: More information can be found in this kbase: https://access.redhat.com/kb/docs/DOC-40265.
CVE-2010-1403 (Critical severity, published 2010-06-06)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, accesses uninitialized memory during the handling of a use element in an SVG document, which allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted document containing XML that triggers a parsing error, related to ProcessInstruction.
CVE-2010-4251 (Moderate severity, published 2010-11-24)
CVSS score: 6.1 (AV:A/AC:L/Au:N/C:N/I:N/A:C)
Description: The socket implementation in net/core/sock.c in the Linux kernel before 2.6.34 does not properly manage a backlog of received packets, which allows remote attackers to cause a denial of service (memory consumption) by sending a large amount of network traffic, as demonstrated by netperf UDP tests.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG as they have already backported the fixes for this issue. Future kernel updates in Red Hat Enterprise Linux 6 may address this flaw. Red Hat Enterprise Linux 4 is now in Production 3 of the maintenance life-cycle, https://access.redhat.com/support/policy/updates/errata/, therefore the fix for this issue is not currently planned to be included in the future updates.
CVE-2010-4528 (Moderate severity, published 2010-12-25)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Description: directconn.c in the MSN protocol plugin in libpurple 2.7.6 through 2.7.8 in Pidgin before 2.7.9 allows remote authenticated users to cause a denial of service (NULL pointer dereference and application crash) via a short p2pv2 packet in a DirectConnect (aka direct connection) session.
Statement: This issue did not affect the versions of pidgin package as shipped with
Red Hat Enterprise Linux 4, 5, and 6 as this issue is specific to versions
of libpurple from 2.7.6 up to 2.7.8.
CVE-2010-0838 (Critical severity, published 2010-03-29)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.
CVE-2010-2805 (Important severity, published 2010-08-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: The FT_Stream_EnterFrame function in base/ftstream.c in FreeType before 2.4.2 does not properly validate certain position values, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font file.
Statement: Not vulnerable. This issue did not affect the versions of freetype as
shipped with Red Hat Enterprise Linux 3, 4, or 5.
CVE-2010-0091 (Moderate severity, published 2010-03-29)
CVSS score: 4.3 (AV:N/AC:M/Au:N/C:P/I:N/A:N)
Description: Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, and 1.4.2_25 allows remote attackers to affect confidentiality via unknown vectors, a different vulnerability than CVE-2010-0084.
CVE-2010-2940 (Important severity, published 2010-08-23)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-284
Description: The auth_send function in providers/ldap/ldap_auth.c in System Security Services Daemon (SSSD) 1.3.0, when LDAP authentication and anonymous bind are enabled, allows remote attackers to bypass the authentication requirements of pam_authenticate via an empty password.
CVE-2010-4197 (Moderate severity, published 2010-11-03)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in WebKit, as used in Google Chrome before 7.0.517.44, webkitgtk before 1.2.6, and other products, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving text editing.
CVE-2010-3652 (Critical severity, published 2010-11-03)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Unspecified vulnerability in Adobe Flash Player before 9.0.289.0 and 10.x before 10.1.102.64 on Windows, Mac OS X, Linux, and Solaris, and 10.1.95.1 on Android, allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unknown vectors, a different vulnerability than CVE-2010-3640, CVE-2010-3641, CVE-2010-3642, CVE-2010-3643, CVE-2010-3644, CVE-2010-3645, CVE-2010-3646, CVE-2010-3647, CVE-2010-3648, CVE-2010-3649, and CVE-2010-3650.
CVE-2010-3625 (Critical severity, published 2010-10-04)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on Windows and Mac OS X, allow attackers to execute arbitrary code via unspecified vectors, related to a "prefix protocol handler vulnerability."
CVE-2010-2171 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via vectors related to SWF files, decompression of embedded JPEG image data, and the DefineBits and other unspecified tags, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, CVE-2010-2187, and CVE-2010-2188.
CVE-2010-2521 (Important severity, published 2010-04-19)
CVSS score: 8.3 (AV:A/AC:L/Au:N/C:C/I:C/A:C)
CWE: CWE-119
Description: Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.
Statement: This issue did not affect the versions of the Linux kernel as shipped with Red
Hat Enterprise Linux 3 as it did not include support for Network File System (NFS) version 4. Future updates in Red Hat Enterprise 4, 5, and Red Hat Enterprise MRG may address this flaw.
CVE-2010-1161 (Low severity, published 2010-04-01)
CVSS score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)
Description: Race condition in GNU nano before 2.2.4, when run by root to edit a file that is not owned by root, allows local user-assisted attackers to change the ownership of arbitrary files via vectors related to the creation of backup files.
Statement: This issue was corrected in Red Hat Enterprise Linux 6 prior to its initial release.

Red Hat Enterprise Linux 5 is now in Production 3 Phase of the support and maintenance life cycle. This has been rated as having Low security impact and is not currently planned to be addressed in future updates for this or earlier releases. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.
CVE-2010-2063 (Critical severity, published 2010-06-15)
CVSS score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CWE: CWE-119
Description: Buffer overflow in the SMB1 packet chaining implementation in the chain_reply function in process.c in smbd in Samba 3.0.x before 3.3.13 allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a crafted field in a packet.
CVE-2010-4158 (Low severity, published 2010-11-09)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: The sk_run_filter function in net/core/filter.c in the Linux kernel before 2.6.36.2 does not check whether a certain memory location has been initialized before executing a (1) BPF_S_LD_MEM or (2) BPF_S_LDX_MEM instruction, which allows local users to obtain potentially sensitive information from kernel stack memory via a crafted socket filter.
CVE-2010-0727 (Moderate severity, published 2010-03-10)
CVSS score: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Description: The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
Statement: This issue did not affect the version of Linux kernel as shipped with Red Hat Enterprise MRG, as it did not include support for the GFS and GFS2 file systems.

For the GFS issue, it was addressed in Red Hat Enterprise Linux 3 in the gfs package, 4 in the GFS-kernel package, and 5 in the gfs-kmod package, via RHSA-2010:9493, RHSA-2010:9494, RHSA-2010:0291 respectively.

For the GFS2 issue, it was addressed in Red Hat Enterprise Linux 5 in the kernel package via RHSA-2010:0178.
CVE-2010-4334 (Low severity, published 2010-12-05)
CVSS score: 4 (AV:N/AC:H/Au:N/C:P/I:P/A:N)
Description: The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.
Statement: This issue did not affect perl-IO-Socket-SSL version as shipped with Red Hat Enterprise Linux 5.  Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
CVE-2010-1209 (Critical severity, published 2010-07-19)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: Use-after-free vulnerability in the NodeIterator implementation in Mozilla Firefox 3.5.x before 3.5.11 and 3.6.x before 3.6.7, and SeaMonkey before 2.0.6, allows remote attackers to execute arbitrary code via a crafted NodeFilter that detaches DOM nodes, related to the NodeIterator interface and a javascript callback.
CVE-2010-4267 (Moderate severity, published 2011-01-09)
CVSS score: 4.3 (AV:A/AC:H/Au:N/C:P/I:P/A:P)
Description: Stack-based buffer overflow in the hpmud_get_pml function in io/hpmud/pml.c in Hewlett-Packard Linux Imaging and Printing (HPLIP) 1.6.7, 3.9.8, 3.10.9, and probably other versions allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SNMP response with a large length value.
CVE-2010-3408 (Moderate severity, published 2010-09-13)
CVSS score: 3.7 (AV:L/AC:H/Au:N/C:P/I:P/A:P)
CWE: CWE-416
Description: No description is available for this CVE.
CVE-2010-0731 (Moderate severity, published 2010-03-24)
CVSS score: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Description: The gnutls_x509_crt_get_serial function in the GnuTLS library before 1.2.1, when running on big-endian, 64-bit platforms, calls the asn1_read_value with a pointer to the wrong data type and the wrong length value, which allows remote attackers to bypass the certificate revocation list (CRL) check and cause a stack-based buffer overflow via a crafted X.509 certificate, related to extraction of a serial number.
CVE-2010-2188 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, allows attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code by calling the ActionScript native object 2200 connect method multiple times with different arguments, a different vulnerability than CVE-2010-2160, CVE-2010-2165, CVE-2010-2166, CVE-2010-2171, CVE-2010-2175, CVE-2010-2176, CVE-2010-2177, CVE-2010-2178, CVE-2010-2180, CVE-2010-2182, CVE-2010-2184, and CVE-2010-2187.
CVE-2010-2167 (Critical severity, published 2010-06-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Multiple heap-based buffer overflows in Adobe Flash Player before 9.0.277.0 and 10.x before 10.1.53.64, and Adobe AIR before 2.0.2.12610, might allow attackers to execute arbitrary code via unspecified vectors related to malformed (1) GIF or (2) JPEG data.
CVE-2010-0789 (Low severity, published 2010-01-25)
CVSS score: 1.7 (AV:L/AC:L/Au:S/C:N/I:N/A:P)
Description: fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.
Statement: This issue affects Red Hat Enterprise Linux 5 because it ships fusermount suid root, however the impact of this flaw is minimized due to the fact that only members in group fuse may use it the executable is owned root:fuse and mode 4750.

Red Hat Enterprise Linux 3 and 4 do not provide the fuse package.

The Red Hat Product Security has rated this issue as having low security impact, a future update may address this flaw. More information regarding issue severity can be found here:

https://access.redhat.com/security/updates/classification/
CVE-2010-4375 (Critical severity, published 2010-12-09)
CVSS score: 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Description: Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1, Mac RealPlayer 11.0 through 11.1, Linux RealPlayer 11.0.2.1744, and possibly HelixPlayer 1.0.6 and other versions, allows remote attackers to execute arbitrary code via malformed multi-rate data in an audio stream.